Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

• Malicious Indicators 15

• External Systems
  • Detected Suricata Alert

    details

    Detected alert "ET MALWARE W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1" (SID: 2024298, Rev: 4, Severity: 1) categorized as "A Network Trojan was detected" (PUA/PUP/Adware)
    Detected alert "ET EXPLOIT Possible ETERNALBLUE Probe MS17-010 (MSF style)" (SID: 2025649, Rev: 3, Severity: 1) categorized as "A Network Trojan was detected"
    Detected alert "ET EXPLOIT Possible ETERNALBLUE Probe MS17-010 (Generic Flags)" (SID: 2025992, Rev: 2, Severity: 1) categorized as "A Network Trojan was detected"

    source

    Suricata Alerts

    relevance

    10/10

  • Sample was identified as malicious by a large number of Antivirus engines

    details

    64/70 Antivirus vendors marked sample as malicious (91% detection rate)

    source

    External System

    relevance

    10/10

  • Sample was identified as malicious by at least one Antivirus engine

    details

    64/70 Antivirus vendors marked sample as malicious (91% detection rate)

    source

    External System

    relevance

    8/10

• General
  • The analysis extracted a file that was identified as malicious

    details

    58/67 Antivirus vendors marked dropped file "MSSECSVC.EXE.6038B8CC.bin" as malicious (classified as "CVE-2017-0147" with 86% detection rate)
    66/71 Antivirus vendors marked dropped file "TASKSCHE.EXE.6038BB10.bin" as malicious (classified as "Trojan.Ransom.WannaCryptor" with 92% detection rate)
    66/71 Antivirus vendors marked dropped file "tasksche.exe" as malicious (classified as "Trojan.Ransom.WannaCryptor" with 92% detection rate)
    58/67 Antivirus vendors marked dropped file "mssecsvc.exe" as malicious (classified as "CVE-2017-0147" with 86% detection rate)
    14/59 Antivirus vendors marked dropped file "m_dutch.wnry" as malicious (classified as "Trojan.Filecoder" with 23% detection rate)
    15/60 Antivirus vendors marked dropped file "m_finnish.wnry" as malicious (classified as "Trojan.Filecoder" with 25% detection rate)
    16/61 Antivirus vendors marked dropped file "m_vietnamese.wnry" as malicious (classified as "Trojan.Filecoder" with 26% detection rate)
    12/59 Antivirus vendors marked dropped file "m_turkish.wnry" as malicious (classified as "Trojan.Filecoder" with 20% detection rate)
    12/59 Antivirus vendors marked dropped file "m_russian.wnry" as malicious (classified as "Trojan.Filecoder" with 20% detection rate)
    14/60 Antivirus vendors marked dropped file "m_indonesian.wnry" as malicious (classified as "Trojan.Filecoder" with 23% detection rate)
    18/61 Antivirus vendors marked dropped file "m_italian.wnry" as malicious (classified as "Trojan.Filecoder" with 29% detection rate)
    15/60 Antivirus vendors marked dropped file "m_french.wnry" as malicious (classified as "Trojan.Filecoder" with 25% detection rate)
    17/61 Antivirus vendors marked dropped file "m_chinese _traditional_.wnry" as malicious (classified as "Trojan.Filecoder" with 27% detection rate)
    14/60 Antivirus vendors marked dropped file "m_spanish.wnry" as malicious (classified as "Trojan.Filecoder" with 23% detection rate)
    15/61 Antivirus vendors marked dropped file "m_portuguese.wnry" as malicious (classified as "Trojan.Filecoder" with 24% detection rate)

    source

    Extracted File

    relevance

    10/10

  • The analysis spawned a process that was identified as malicious

    details

    58/67 Antivirus vendors marked spawned process "mssecsvc.exe" (PID: 3240) as malicious (classified as "CVE-2017-0147" with 86% detection rate)
    58/67 Antivirus vendors marked spawned process "mssecsvc.exe" (PID: 2796) as malicious (classified as "CVE-2017-0147" with 86% detection rate)
    66/71 Antivirus vendors marked spawned process "tasksche.exe" (PID: 2740) as malicious (classified as "Trojan.Ransom.WannaCryptor" with 92% detection rate)
    66/71 Antivirus vendors marked spawned process "tasksche.exe" (PID: 3732) as malicious (classified as "Trojan.Ransom.WannaCryptor" with 92% detection rate)
    66/71 Antivirus vendors marked spawned process "tasksche.exe" (PID: 1336) as malicious (classified as "Trojan.Ransom.WannaCryptor" with 92% detection rate)

    source

    Monitored Target

    relevance

    10/10

• Installation/Persistence
  • Writes data to a remote process

    details

    "rundll32.exe" wrote 32 bytes to a remote process "C:\Windows\mssecsvc.exe" (Handle: 212)
    "rundll32.exe" wrote 52 bytes to a remote process "C:\Windows\mssecsvc.exe" (Handle: 212)
    "rundll32.exe" wrote 4 bytes to a remote process "C:\Windows\mssecsvc.exe" (Handle: 212)
    "mssecsvc.exe" wrote 32 bytes to a remote process "C:\Windows\tasksche.exe" (Handle: 720)
    "mssecsvc.exe" wrote 52 bytes to a remote process "C:\Windows\tasksche.exe" (Handle: 720)
    "mssecsvc.exe" wrote 4 bytes to a remote process "C:\Windows\tasksche.exe" (Handle: 720)
    "tasksche.exe" wrote 32 bytes to a remote process "%ALLUSERSPROFILE%\tvzfcptuxgtlf819\tasksche.exe" (Handle: 140)
    "tasksche.exe" wrote 52 bytes to a remote process "C:\ProgramData\tvzfcptuxgtlf819\tasksche.exe" (Handle: 140)
    "tasksche.exe" wrote 4 bytes to a remote process "C:\ProgramData\tvzfcptuxgtlf819\tasksche.exe" (Handle: 140)
    "tasksche.exe" wrote 32 bytes to a remote process "C:\Windows\System32\icacls.exe" (Handle: 136)
    "tasksche.exe" wrote 52 bytes to a remote process "C:\Windows\System32\icacls.exe" (Handle: 136)
    "tasksche.exe" wrote 4 bytes to a remote process "C:\Windows\System32\icacls.exe" (Handle: 136)
    "tasksche.exe" wrote 32 bytes to a remote process "C:\Windows\System32\attrib.exe" (Handle: 136)
    "tasksche.exe" wrote 52 bytes to a remote process "C:\Windows\System32\attrib.exe" (Handle: 136)
    "tasksche.exe" wrote 4 bytes to a remote process "C:\Windows\System32\attrib.exe" (Handle: 136)
    "tasksche.exe" wrote 32 bytes to a remote process "C:\Windows\System32\attrib.exe" (Handle: 64)
    "tasksche.exe" wrote 52 bytes to a remote process "C:\Windows\System32\attrib.exe" (Handle: 64)
    "tasksche.exe" wrote 4 bytes to a remote process "C:\Windows\System32\attrib.exe" (Handle: 64)
    "tasksche.exe" wrote 32 bytes to a remote process "C:\Windows\System32\icacls.exe" (Handle: 64)
    "tasksche.exe" wrote 52 bytes to a remote process "C:\Windows\System32\icacls.exe" (Handle: 64)
    "tasksche.exe" wrote 4 bytes to a remote process "C:\Windows\System32\icacls.exe" (Handle: 64)

    source

    API Call

    relevance

    6/10

    ATT&CK ID

    T1055 (Show technique in the MITRE ATT&CK™ matrix)

• Network Related
  • Contacts very many different hosts

    details

    Contacted 60 (or more) hosts in at least 19 different countries

    source

    Network Traffic

    relevance

    9/10

• Pattern Matching
  • YARA signature match

    details

    YARA signature "MS17_010_WanaCry_worm" classified file "22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6.bin" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "PC NETWORK PROGRAM 1.0,LANMAN1.0,Windows for Workgroups 3.1a,__TREEID__PLACEHOLDER__,__USERID__PLACEHOLDER__,h6agLCqPqVyXi2VSQ8O6Yb9ijBX54j,h54WfF9cGigWFEx92bzmOd0UOaZlM,tpGFEoLOU6+5I78Toh/nHs/RAP" (Reference: https://www.exploit-db.com/exploits/41987/, Author: Felipe Molina (@felmoltor))
    YARA signature "WannaDecryptor" classified file "22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6.bin" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "taskdl.exe,taskse.exe,r.wnry,s.wnry,t.wnry,u.wnry,msg/m_"
    YARA signature "WannaCry_RansomwareEx" classified file "22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6.bin" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "icacls . /grant Everyone:F /T /C /Q,taskdl.exe,tasksche.exe,Global\MsWinZonesCacheCounterMutexA,WNcry@2ol7,www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com,mssecsvc.exe,C:\%s\qeriuwjhrf,C:\%s\%s, Windows 10 --> ,cmd.exe /c "%s",msg/m_portuguese.wnry,5c005c003100390032002e003100360038002e00350036002e00320030005c004900500043002400,5c005c003100370032002e00310036002e00390039002e0035005c004900500043002400,10ac720d3dffff1fac7706b801000000,4424648ac64424650ec644246680c644,18df6c2414dc64242cdc6c245cdc1588,09ff763050ff562c5959473b7e0c7c,c1ea1dc1ee1e83e20183e6018d1456,8d48fff7d18d4410ff23f123c1" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth (with the help of binar.ly))
    YARA signature "WannaDecryptor" classified file "tasksche.exe" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "taskdl.exe,taskse.exe,r.wnry,s.wnry,t.wnry,u.wnry,msg/m_"
    YARA signature "WannaCry_RansomwareEx" classified file "tasksche.exe" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "icacls . /grant Everyone:F /T /C /Q,taskdl.exe,tasksche.exe,Global\MsWinZonesCacheCounterMutexA,WNcry@2ol7, Windows 10 --> ,cmd.exe /c "%s",msg/m_portuguese.wnry,09ff763050ff562c5959473b7e0c7c,c1ea1dc1ee1e83e20183e6018d1456,8d48fff7d18d4410ff23f123c1" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth (with the help of binar.ly))
    YARA signature "WannaDecryptor" classified file "TASKSCHE.EXE.6038BB10.bin" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "taskdl.exe,taskse.exe,r.wnry,s.wnry,t.wnry,u.wnry,msg/m_"
    YARA signature "WannaCry_RansomwareEx" classified file "TASKSCHE.EXE.6038BB10.bin" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "icacls . /grant Everyone:F /T /C /Q,taskdl.exe,tasksche.exe,Global\MsWinZonesCacheCounterMutexA,WNcry@2ol7, Windows 10 --> ,cmd.exe /c "%s",msg/m_portuguese.wnry,09ff763050ff562c5959473b7e0c7c,c1ea1dc1ee1e83e20183e6018d1456,8d48fff7d18d4410ff23f123c1" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth (with the help of binar.ly))
    YARA signature "MS17_010_WanaCry_worm" classified file "MSSECSVC.EXE.6038B8CC.bin" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "PC NETWORK PROGRAM 1.0,LANMAN1.0,Windows for Workgroups 3.1a,__TREEID__PLACEHOLDER__,__USERID__PLACEHOLDER__,h6agLCqPqVyXi2VSQ8O6Yb9ijBX54j,h54WfF9cGigWFEx92bzmOd0UOaZlM,tpGFEoLOU6+5I78Toh/nHs/RAP" (Reference: https://www.exploit-db.com/exploits/41987/, Author: Felipe Molina (@felmoltor))
    YARA signature "WannaDecryptor" classified file "MSSECSVC.EXE.6038B8CC.bin" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "taskdl.exe,taskse.exe,r.wnry,s.wnry,t.wnry,u.wnry,msg/m_"
    YARA signature "WannaCry_RansomwareEx" classified file "MSSECSVC.EXE.6038B8CC.bin" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "icacls . /grant Everyone:F /T /C /Q,taskdl.exe,tasksche.exe,Global\MsWinZonesCacheCounterMutexA,WNcry@2ol7,www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com,mssecsvc.exe,C:\%s\qeriuwjhrf,C:\%s\%s, Windows 10 --> ,cmd.exe /c "%s",msg/m_portuguese.wnry,5c005c003100390032002e003100360038002e00350036002e00320030005c004900500043002400,5c005c003100370032002e00310036002e00390039002e0035005c004900500043002400,10ac720d3dffff1fac7706b801000000,4424648ac64424650ec644246680c644,18df6c2414dc64242cdc6c245cdc1588,09ff763050ff562c5959473b7e0c7c,c1ea1dc1ee1e83e20183e6018d1456,8d48fff7d18d4410ff23f123c1" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth (with the help of binar.ly))
    YARA signature "WannaCry_Ransomware_Gen" classified file "MSSECSVC.EXE.6038B8CC.bin" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "__TREEID__PLACEHOLDER__,__USERID__PLACEHOLDER__,Windows for Workgroups 3.1a,PC NETWORK PROGRAM 1.0,LANMAN1.0" (Reference: https://www.us-cert.gov/ncas/alerts/TA17-132A, Author: Florian Roth (based on rule by US CERT))
    YARA signature "MS17_010_WanaCry_worm" classified file "mssecsvc.exe" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "PC NETWORK PROGRAM 1.0,LANMAN1.0,Windows for Workgroups 3.1a,__TREEID__PLACEHOLDER__,__USERID__PLACEHOLDER__,h6agLCqPqVyXi2VSQ8O6Yb9ijBX54j,h54WfF9cGigWFEx92bzmOd0UOaZlM,tpGFEoLOU6+5I78Toh/nHs/RAP" (Reference: https://www.exploit-db.com/exploits/41987/, Author: Felipe Molina (@felmoltor))
    YARA signature "WannaDecryptor" classified file "mssecsvc.exe" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "taskdl.exe,taskse.exe,r.wnry,s.wnry,t.wnry,u.wnry,msg/m_"
    YARA signature "WannaCry_RansomwareEx" classified file "mssecsvc.exe" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "icacls . /grant Everyone:F /T /C /Q,taskdl.exe,tasksche.exe,Global\MsWinZonesCacheCounterMutexA,WNcry@2ol7,www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com,mssecsvc.exe,C:\%s\qeriuwjhrf,C:\%s\%s, Windows 10 --> ,cmd.exe /c "%s",msg/m_portuguese.wnry,5c005c003100390032002e003100360038002e00350036002e00320030005c004900500043002400,5c005c003100370032002e00310036002e00390039002e0035005c004900500043002400,10ac720d3dffff1fac7706b801000000,4424648ac64424650ec644246680c644,18df6c2414dc64242cdc6c245cdc1588,09ff763050ff562c5959473b7e0c7c,c1ea1dc1ee1e83e20183e6018d1456,8d48fff7d18d4410ff23f123c1" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth (with the help of binar.ly))
    YARA signature "WannaCry_Ransomware_Gen" classified file "mssecsvc.exe" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "__TREEID__PLACEHOLDER__,__USERID__PLACEHOLDER__,Windows for Workgroups 3.1a,PC NETWORK PROGRAM 1.0,LANMAN1.0" (Reference: https://www.us-cert.gov/ncas/alerts/TA17-132A, Author: Florian Roth (based on rule by US CERT))
    YARA signature "MS17_010_WanaCry_worm" classified file "all.bstring" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "PC NETWORK PROGRAM 1.0,LANMAN1.0,Windows for Workgroups 3.1a,__TREEID__PLACEHOLDER__,__USERID__PLACEHOLDER__,h6agLCqPqVyXi2VSQ8O6Yb9ijBX54j,h54WfF9cGigWFEx92bzmOd0UOaZlM,tpGFEoLOU6+5I78Toh/nHs/RAP" (Reference: https://www.exploit-db.com/exploits/41987/, Author: Felipe Molina (@felmoltor))
    YARA signature "WannaDecryptor" classified file "all.bstring" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "taskdl.exe,taskse.exe,msg/m_"
    YARA signature "WannaCry_Ransomware_Gen" classified file "all.bstring" as "ransomware,wcry,wannacry,wanacrypt0r" based on indicators: "__TREEID__PLACEHOLDER__,__USERID__PLACEHOLDER__,Windows for Workgroups 3.1a,PC NETWORK PROGRAM 1.0,LANMAN1.0" (Reference: https://www.us-cert.gov/ncas/alerts/TA17-132A, Author: Florian Roth (based on rule by US CERT))

    source

    YARA Signature

    relevance

    10/10

• System Security
  • Modifies the access control lists of files

    details

    Process "icacls.exe" with commandline "icacls . /grant Everyone:F /T /C /Q" (Show Process)
    Process "icacls.exe" with commandline "icacls . /grant Everyone:F /T /C /Q" (Show Process)

    source

    Monitored Target

    relevance

    5/10

    ATT&CK ID

    T1044 (Show technique in the MITRE ATT&CK™ matrix)

• Unusual Characteristics
  • Checks for a resource fork (ADS) file

    details

    "mssecsvc.exe" checked file "C:"

    source

    API Call

    relevance

    5/10

  • Spawns a lot of processes

    details

    Spawned process "mssecsvc.exe" (Show Process)
    Spawned process "mssecsvc.exe" with commandline "-m security" (Show Process)
    Spawned process "tasksche.exe" with commandline "/i" (Show Process)
    Spawned process "tasksche.exe" (Show Process)
    Spawned process "tasksche.exe" (Show Process)
    Spawned process "attrib.exe" with commandline "attrib +h ." (Show Process)
    Spawned process "icacls.exe" with commandline "icacls . /grant Everyone:F /T /C /Q" (Show Process)
    Spawned process "attrib.exe" with commandline "attrib +h ." (Show Process)
    Spawned process "icacls.exe" with commandline "icacls . /grant Everyone:F /T /C /Q" (Show Process)

    source

    Monitored Target

    relevance

    8/10

• Hiding 4 Malicious Indicators
  • All indicators are available only in the private webservice or standalone version

• Suspicious Indicators 12

• Anti-Reverse Engineering
  • PE file has unusual entropy sections

    details

    .rsrc
    .rsrc with unusual entropies 7.71095306051
    7.72627063923

    source

    Static Parser

    relevance

    10/10

• External Systems
  • Found an IP/URL artifact that was identified as malicious by at least one reputation engine

    details

    4/84 reputation engines marked "http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com" as malicious (4% detection rate)

    source

    External System

    relevance

    10/10

• Installation/Persistence
  • Chained signature (with api-8701...). Detects file write then launch as EXE

    details

    Chained signature (with api-8701...). Detects file write then launch as EXE

    source

    API Call

    relevance

    8/10

  • Creates new processes

    details

    "rundll32.exe" is creating a new process (Name: "%WINDIR%\mssecsvc.exe", Handle: 212)
    "mssecsvc.exe" is creating a new process (Name: "%WINDIR%\tasksche.exe", Handle: 720)
    "tasksche.exe" is creating a new process (Name: "%ALLUSERSPROFILE%\tvzfcptuxgtlf819\tasksche.exe", Handle: 140)
    "tasksche.exe" is creating a new process (Name: "%WINDIR%\System32\attrib.exe", Handle: 136)
    "tasksche.exe" is creating a new process (Name: "%WINDIR%\System32\icacls.exe", Handle: 136)
    "tasksche.exe" is creating a new process
    "tasksche.exe" is creating a new process (Name: "%WINDIR%\System32\icacls.exe", Handle: 64)
    "tasksche.exe" is creating a new process (Name: "%WINDIR%\System32\attrib.exe", Handle: 64)

    source

    API Call

    relevance

    8/10

  • Drops executable files

    details

    "MSSECSVC.EXE.6038B8CC.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
    "TASKSCHE.EXE.6038BB10.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
    "tasksche.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
    "mssecsvc.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"

    source

    Extracted File

    relevance

    10/10

• Network Related
  • Found potential IP address in binary/memory

    details

    Potential IP "192.168.56.20" found in string "\\192.168.56.20\IPC$"

    source

    String

    relevance

    3/10

  • Sends traffic on typical HTTP outbound port, but without HTTP header

    details

    TCP traffic to 104.16.173.80 on port 80 is sent without HTTP header

    source

    Network Traffic

    relevance

    5/10

    ATT&CK ID

    T1043 (Show technique in the MITRE ATT&CK™ matrix)

• System Security
  • Modifies proxy settings

    details

    "mssecsvc.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000")
    "mssecsvc.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER")
    "mssecsvc.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE")
    "mssecsvc.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
    "mssecsvc.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
    "mssecsvc.exe" (Access type: "SETVAL"; Path: "HKU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000")
    "mssecsvc.exe" (Access type: "DELETEVAL"; Path: "HKU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER")
    "mssecsvc.exe" (Access type: "DELETEVAL"; Path: "HKU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE")
    "mssecsvc.exe" (Access type: "DELETEVAL"; Path: "HKU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")

    source

    Registry Access

    relevance

    10/10

    ATT&CK ID

    T1112 (Show technique in the MITRE ATT&CK™ matrix)

• Unusual Characteristics
  • Imports suspicious APIs

    details

    CreateProcessA
    LockResource
    WriteFile
    CreateFileA
    FindResourceA
    CreateServiceA
    StartServiceA
    StartServiceCtrlDispatcherA
    GetModuleFileNameA
    GetStartupInfoA
    GetFileSize
    GetProcAddress
    GetModuleHandleA
    GetModuleHandleW
    Sleep
    GetTickCount
    InternetOpenUrlA
    InternetCloseHandle
    InternetOpenA
    socket
    recv
    send
    WSAStartup
    connect
    closesocket
    RegCloseKey
    RegCreateKeyW
    LoadLibraryA
    GetFileAttributesA
    CopyFileA
    VirtualProtect
    GetFileAttributesW
    CreateDirectoryA
    CreateDirectoryW
    GetComputerNameW
    GetFileSizeEx
    GetTempPathW
    TerminateProcess
    VirtualAlloc

    source

    Static Parser

    relevance

    1/10

  • Installs hooks/patches the running process

    details

    "rundll32.exe" wrote bytes "88eadc761656dd7681ecdc764557dc763105dc76ca9edc76cda6dc768220d876000000009498cd7651c1cd76ee9ccd76ec32d77654d3ce7600000000" to virtual address "0x10002000" (part of module "2A8EFBFADD798F6111340F7C1C956BEE.DLL")
    "mssecsvc.exe" wrote bytes "e7393577e1a639772e713977ee29397785e234776da03977906438773ad53f7726e43477d16d3977003d3777804b377700000000ad3787758b2d8775b641877500000000" to virtual address "0x74C01000" (part of module "WSHIP6.DLL")
    "mssecsvc.exe" wrote bytes "f8110000" to virtual address "0x750D12CC" (part of module "SSPICLI.DLL")
    "mssecsvc.exe" wrote bytes "f8110d75" to virtual address "0x750E834C" (part of module "SSPICLI.DLL")
    "mssecsvc.exe" wrote bytes "f8110000" to virtual address "0x750D1408" (part of module "SSPICLI.DLL")
    "mssecsvc.exe" wrote bytes "b89012036fffe0" to virtual address "0x750D1248" (part of module "SSPICLI.DLL")
    "mssecsvc.exe" wrote bytes "48120d75" to virtual address "0x750E8348" (part of module "SSPICLI.DLL")
    "mssecsvc.exe" wrote bytes "f8110d75" to virtual address "0x750E8368" (part of module "SSPICLI.DLL")
    "mssecsvc.exe" wrote bytes "68130000" to virtual address "0x75871680" (part of module "WS2_32.DLL")
    "mssecsvc.exe" wrote bytes "f8110d75" to virtual address "0x750E83C4" (part of module "SSPICLI.DLL")
    "mssecsvc.exe" wrote bytes "48120d75" to virtual address "0x750E8364" (part of module "SSPICLI.DLL")
    "mssecsvc.exe" wrote bytes "fae63477e1a639772e713977ee29397785e234776da0397726e43477d16d3977003d3777804b377700000000ad3787758b2d8775b641877500000000" to virtual address "0x746B1000" (part of module "WSHTCPIP.DLL")
    "mssecsvc.exe" wrote bytes "48120d75" to virtual address "0x750E83C0" (part of module "SSPICLI.DLL")
    "mssecsvc.exe" wrote bytes "f8110d75" to virtual address "0x750E83E0" (part of module "SSPICLI.DLL")
    "mssecsvc.exe" wrote bytes "b88011036fffe0" to virtual address "0x75871368" (part of module "WS2_32.DLL")
    "mssecsvc.exe" wrote bytes "48120000" to virtual address "0x750D139C" (part of module "SSPICLI.DLL")
    "mssecsvc.exe" wrote bytes "48120000" to virtual address "0x750D12DC" (part of module "SSPICLI.DLL")
    "mssecsvc.exe" wrote bytes "a011036f" to virtual address "0x7715E324" (part of module "WININET.DLL")
    "mssecsvc.exe" wrote bytes "48120d75" to virtual address "0x750E83DC" (part of module "SSPICLI.DLL")
    "mssecsvc.exe" wrote bytes "b81015036fffe0" to virtual address "0x750D11F8" (part of module "SSPICLI.DLL")

    source

    Hook Detection

    relevance

    10/10

    ATT&CK ID

    T1179 (Show technique in the MITRE ATT&CK™ matrix)

• Hiding 2 Suspicious Indicators
  • All indicators are available only in the private webservice or standalone version

• Informative 13

• External Systems
  • Detected Suricata Alert

    details

    Detected alert "ET SCAN Behavioral Unusual Port 445 traffic Potential Scan or Infection" (SID: 2001569, Rev: 15, Severity: 3) categorized as "Misc activity"

    source

    Suricata Alerts

    relevance

    10/10

• General
  • Contacts domains

    details

    "www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com"

    source

    Network Traffic

    relevance

    1/10

  • Contacts server

    details

    "104.16.173.80:80"
    "123.119.235.225:445"
    "171.243.141.156:445"
    "22.190.114.199:445"
    "19.28.211.242:445"
    "51.187.114.224:445"
    "80.93.187.33:445"
    "191.7.5.28:445"
    "74.66.141.75:445"
    "72.55.56.162:445"
    "182.74.141.79:445"
    "66.120.107.41:445"
    "112.61.249.78:445"
    "159.170.228.202:445"
    "41.61.70.132:445"
    "161.154.238.120:445"
    "207.194.34.20:445"
    "207.27.9.151:445"
    "47.143.47.147:445"
    "106.131.54.225:445"

    source

    Network Traffic

    relevance

    1/10

  • Creates mutants

    details

    "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex"
    "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex"
    "Local\ZonesCacheCounterMutex"
    "Local\ZonesLockedCacheCounterMutex"
    "\BaseNamedObjects\Local\ZonesCacheCounterMutex"
    "\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex"

    source

    Created Mutant

    relevance

    3/10

  • GETs files from a webserver

    details

    "GET / HTTP/1.1
    Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    Cache-Control: no-cache"

    source

    Network Traffic

    relevance

    5/10

  • Process launched with changed environment

    details

    Process "mssecsvc.exe" (Show Process) was launched with modified environment variables: "Path, LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP"
    Process "mssecsvc.exe" (Show Process) was launched with missing environment variables: "LOGONSERVER, HOMEPATH, HOMEDRIVE"
    Process "tasksche.exe" (Show Process) was launched with new environment variables: "LOGONSERVER="\\HAPUBWS-PC", HOMEPATH="\Users\BoXuzF2", HOMEDRIVE="C:""
    Process "tasksche.exe" (Show Process) was launched with modified environment variables: "Path, LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP"
    Process "tasksche.exe" (Show Process) was launched with new environment variables: "PROMPT="$P$G""
    Process "tasksche.exe" (Show Process) was launched with modified environment variables: "Path, LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP"
    Process "tasksche.exe" (Show Process) was launched with missing environment variables: "LOGONSERVER, HOMEPATH, HOMEDRIVE"
    Process "tasksche.exe" (Show Process) was launched with new environment variables: "LOGONSERVER="\\HAPUBWS-PC", HOMEPATH="\Users\BoXuzF2", HOMEDRIVE="C:""
    Process "tasksche.exe" (Show Process) was launched with modified environment variables: "Path, LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP"
    Process "tasksche.exe" (Show Process) was launched with missing environment variables: "PROMPT"

    source

    Monitored Target

    relevance

    10/10

  • Spawns new processes

    details

    Spawned process "rundll32.exe" with commandline ""C:\2a8efbfadd798f6111340f7c1c956bee.dll",#1" (Show Process)
    Spawned process "mssecsvc.exe" (Show Process)
    Spawned process "mssecsvc.exe" with commandline "-m security" (Show Process)
    Spawned process "tasksche.exe" with commandline "/i" (Show Process)
    Spawned process "tasksche.exe" (Show Process)
    Spawned process "tasksche.exe" (Show Process)
    Spawned process "attrib.exe" with commandline "attrib +h ." (Show Process)
    Spawned process "icacls.exe" with commandline "icacls . /grant Everyone:F /T /C /Q" (Show Process)
    Spawned process "attrib.exe" with commandline "attrib +h ." (Show Process)
    Spawned process "icacls.exe" with commandline "icacls . /grant Everyone:F /T /C /Q" (Show Process)

    source

    Monitored Target

    relevance

    3/10

  • Spawns new processes that are not known child processes

    details

    Spawned process "rundll32.exe" with commandline ""C:\2a8efbfadd798f6111340f7c1c956bee.dll",#1" (Show Process)
    Spawned process "mssecsvc.exe" (Show Process)
    Spawned process "mssecsvc.exe" with commandline "-m security" (Show Process)
    Spawned process "tasksche.exe" with commandline "/i" (Show Process)
    Spawned process "tasksche.exe" (Show Process)
    Spawned process "tasksche.exe" (Show Process)
    Spawned process "attrib.exe" with commandline "attrib +h ." (Show Process)
    Spawned process "icacls.exe" with commandline "icacls . /grant Everyone:F /T /C /Q" (Show Process)
    Spawned process "attrib.exe" with commandline "attrib +h ." (Show Process)
    Spawned process "icacls.exe" with commandline "icacls . /grant Everyone:F /T /C /Q" (Show Process)

    source

    Monitored Target

    relevance

    3/10

  • The input sample possibly contains the RDTSCP instruction

    details

    Found VM detection artifact "RDTSCP trick" in "22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6.bin" (Offset: 774762)

    source

    Extracted File

    relevance

    5/10

    ATT&CK ID

    T1497 (Show technique in the MITRE ATT&CK™ matrix)

• Installation/Persistence
  • Dropped files

    details

    "MSSECSVC.EXE.6038B8CC.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
    "TASKSCHE.EXE.6038BB10.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
    "tasksche.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
    "mssecsvc.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
    "m_dutch.wnry" has type "Rich Text Format data version 1 unknown character set"
    "m_finnish.wnry" has type "Rich Text Format data version 1 unknown character set"
    "m_vietnamese.wnry" has type "Rich Text Format data version 1 unknown character set"
    "m_turkish.wnry" has type "Rich Text Format data version 1 unknown character set"
    "m_russian.wnry" has type "Rich Text Format data version 1 unknown character set"
    "m_indonesian.wnry" has type "Rich Text Format data version 1 unknown character set"
    "m_italian.wnry" has type "Rich Text Format data version 1 unknown character set"
    "m_french.wnry" has type "Rich Text Format data version 1 unknown character set"
    "m_chinese _traditional_.wnry" has type "Rich Text Format data version 1 unknown character set"
    "m_spanish.wnry" has type "Rich Text Format data version 1 unknown character set"
    "m_portuguese.wnry" has type "Rich Text Format data version 1 unknown character set"
    "c.wnry" has type "data"

    source

    Extracted File

    relevance

    3/10

  • Touches files in the Windows directory

    details

    "rundll32.exe" touched file "%WINDIR%\AppPatch\sysmain.sdb"
    "rundll32.exe" touched file "%WINDIR%\System32\rundll32.exe"
    "rundll32.exe" touched file "%WINDIR%\AppPatch\AcLayers.dll"
    "rundll32.exe" touched file "%WINDIR%\mssecsvc.exe"
    "rundll32.exe" touched file "%WINDIR%\System32\en-US\rundll32.exe.mui"
    "mssecsvc.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies"
    "mssecsvc.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies\FZD0P3G2.txt"
    "mssecsvc.exe" touched file "%WINDIR%\tasksche.exe"
    "mssecsvc.exe" touched file "%WINDIR%\AppPatch\sysmain.sdb"

    source

    API Call

    relevance

    7/10

• Network Related
  • Found potential URL in binary/memory

    details

    Pattern match: "http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com"
    Pattern match: "www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com"
    Pattern match: "http://schemas.microsoft.com/o"
    Pattern match: "http://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1501\margr1502\margt1701\margb1440\gutter0\ltrsect"
    Pattern match: "http://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1034\margr1034\margt1701\margb1440\gutter0\ltrsect"
    Pattern match: "http://schemas.microsoft"

    source

    String

    relevance

    10/10

• Unusual Characteristics
  • Matched Compiler/Packer signature

    details

    "22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6.bin" was detected as "Microsoft visual C++ 6.0 DLL"
    "MSSECSVC.EXE.6038B8CC.bin" was detected as "Microsoft visual C++ 5.0"
    "TASKSCHE.EXE.6038BB10.bin" was detected as "Microsoft visual C++ 5.0"

    source

    Static Parser

    relevance

    10/10

    ATT&CK ID

    T1045 (Show technique in the MITRE ATT&CK™ matrix)

File Metadata

• File Compositions
• Imported Objects
• File Analysis

File Sections

File Imports

• KERNEL32.dll
• MSVCRT.dll

File Exports

DNS Requests

Domain	Address	Registrar	Country
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com OSINT Associated Artifacts for www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com Whois Field Value Address Botnet Sinkhole City Los Angeles Country US Creation Date Fri, 12 May 2017 00:00:00 GMT Creation Date Fri, 12 May 2017 15:08:04 GMT DNSSEC unsigned Domain Name IUQERFSODP9IFJAPOSDFJHGOSURIJFAEWRWERGWEA.COM EMail abuse@namecheap.com EMail BotnetSinkhole@gmail.com Expiration Date Sat, 12 May 2018 00:00:00 GMT Expiration Date Sat, 12 May 2018 15:08:04 GMT Name Server BRUCE.NS.CLOUDFLARE.COM Name Server SARA.NS.CLOUDFLARE.COM Referral URL http://www.namecheap.com Reigstrar NAMECHEAP INC State CA Status clientTransferProhibited https://icann.org/epp#clientTransferProhibited Status addPeriod https://icann.org/epp#addPeriod Last Update Mon, 15 May 2017 00:00:00 GMT Last Update Mon, 15 May 2017 21:57:30 GMT Whois Server whois.namecheap.com Zip Code 00000 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 820ea99f87c53aab48b4799f1411244cfb806add92cce4b56c3591e373848e81 Threat Level no verdict Positives - Scan Date 02/25/2021 11:42:12 Reference AlienVault 820ea99f87c53aab48b4799f1411244cfb806add92cce4b56c3591e373848e81 no verdict - 02/25/2021 11:42:12 AlienVault Associated SHA256 cabb2358263cc8eb1fed0f8ad1aab96d7d372642c5652370ba9a1fc99c00aa7e Threat Level no verdict Positives - Scan Date 02/25/2021 10:47:14 Reference AlienVault cabb2358263cc8eb1fed0f8ad1aab96d7d372642c5652370ba9a1fc99c00aa7e no verdict - 02/25/2021 10:47:14 AlienVault Associated SHA256 4756f0faada403db000145c50c580b99ea067e1523edfa9f1c357efaf48005d6 Threat Level no verdict Positives - Scan Date 02/25/2021 08:25:54 Reference AlienVault 4756f0faada403db000145c50c580b99ea067e1523edfa9f1c357efaf48005d6 no verdict - 02/25/2021 08:25:54 AlienVault Associated SHA256 810f4f75b333f2ea3562c63dd4b0aada836db2eec0364135d0269449d3f1d3df Threat Level no verdict Positives - Scan Date 02/25/2021 02:53:11 Reference AlienVault 810f4f75b333f2ea3562c63dd4b0aada836db2eec0364135d0269449d3f1d3df no verdict - 02/25/2021 02:53:11 AlienVault Associated SHA256 37ba560783476f581ae3108d340c2705f907b7eca2fa069cbcafab06434bc7c5 Threat Level no verdict Positives - Scan Date 02/24/2021 21:52:31 Reference AlienVault 37ba560783476f581ae3108d340c2705f907b7eca2fa069cbcafab06434bc7c5 no verdict - 02/24/2021 21:52:31 AlienVault	104.16.173.80 TTL: 299	NAMECHEAP INC Name Server: BRUCE.NS.CLOUDFLARE.COM Creation Date: Fri, 12 May 2017 00:00:00 GMT	United States

Contacted Hosts

Displaying the first 1000 contacted hosts. The remaining 4326 entries are available in the full HTML report, but download of the full report is disabled.

IP Address	Port/Protocol	Associated Process	Details
104.16.173.80 OSINT Associated Artifacts for 104.16.173.80 Details Associated URL Threat Level Positives Scan Date Reference Associated URL http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/ Threat Level malicious Positives 4/84 Scan Date 02/26/2021 07:41:46 Reference - http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/ malicious 4/84 02/26/2021 07:41:46 - Associated URL http://104.16.173.80/ Threat Level malicious Positives 2/84 Scan Date 02/26/2021 03:58:13 Reference - http://104.16.173.80/ malicious 2/84 02/26/2021 03:58:13 - Associated URL http://iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/ Threat Level malicious Positives 3/84 Scan Date 02/24/2021 07:05:28 Reference - http://iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/ malicious 3/84 02/24/2021 07:05:28 - Associated URL https://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/ Threat Level malicious Positives 4/83 Scan Date 02/19/2021 16:37:33 Reference - https://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/ malicious 4/83 02/19/2021 16:37:33 - Associated URL http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/favicon.ico Threat Level malicious Positives 5/83 Scan Date 02/16/2021 13:44:12 Reference - http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/favicon.ico malicious 5/83 02/16/2021 13:44:12 - Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 820ea99f87c53aab48b4799f1411244cfb806add92cce4b56c3591e373848e81 Threat Level no verdict Positives - Scan Date 02/25/2021 11:42:12 Reference AlienVault 820ea99f87c53aab48b4799f1411244cfb806add92cce4b56c3591e373848e81 no verdict - 02/25/2021 11:42:12 AlienVault Associated SHA256 cabb2358263cc8eb1fed0f8ad1aab96d7d372642c5652370ba9a1fc99c00aa7e Threat Level no verdict Positives - Scan Date 02/25/2021 10:47:14 Reference AlienVault cabb2358263cc8eb1fed0f8ad1aab96d7d372642c5652370ba9a1fc99c00aa7e no verdict - 02/25/2021 10:47:14 AlienVault Associated SHA256 4756f0faada403db000145c50c580b99ea067e1523edfa9f1c357efaf48005d6 Threat Level no verdict Positives - Scan Date 02/25/2021 08:25:54 Reference AlienVault 4756f0faada403db000145c50c580b99ea067e1523edfa9f1c357efaf48005d6 no verdict - 02/25/2021 08:25:54 AlienVault Associated SHA256 9e6c859d28f0effa20119176b97d37de4af05e0b5afb9ba7f29a691fa073d8d9 Threat Level no verdict Positives - Scan Date 02/24/2021 10:21:38 Reference AlienVault 9e6c859d28f0effa20119176b97d37de4af05e0b5afb9ba7f29a691fa073d8d9 no verdict - 02/24/2021 10:21:38 AlienVault Associated SHA256 995f44982ee996a8c4a51c391968c2d0fd54a620c72819a8ea9a0ef4a2c6c903 Threat Level no verdict Positives - Scan Date 02/24/2021 10:10:51 Reference AlienVault 995f44982ee996a8c4a51c391968c2d0fd54a620c72819a8ea9a0ef4a2c6c903 no verdict - 02/24/2021 10:10:51 AlienVault Details Domain Threat Level Positives Last Resolved Reference Domain www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com Threat Level - Positives - Last Resolved 09/21/2020 05:29:18 VirusTotal Report www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com - - 09/21/2020 05:29:18 Report Domain test.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com Threat Level - Positives - Last Resolved 12/17/2019 19:20:16 VirusTotal Report test.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com - - 12/17/2019 19:20:16 Report Domain iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com Threat Level - Positives - Last Resolved 12/12/2019 16:48:20 VirusTotal Report iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com - - 12/12/2019 16:48:20 Report Domain www.mining.com Threat Level - Positives - Last Resolved 02/03/2019 02:36:30 VirusTotal Report www.mining.com - - 02/03/2019 02:36:30 Report Domain noticiasmineras.mining.com Threat Level - Positives - Last Resolved 11/21/2018 02:47:14 VirusTotal Report noticiasmineras.mining.com - - 11/21/2018 02:47:14 Report	80 TCP	mssecsvc.exe PID: 3240 mssecsvc.exe PID: 2796	United States
123.119.235.225 OSINT Associated Artifacts for 123.119.235.225 Details Domain Threat Level Positives Last Resolved Reference Domain device-f3b7c91a-9be3-4173-bc7d-b7b83366f70f.remotewd.com Threat Level - Positives - Last Resolved 12/01/2020 20:54:46 VirusTotal Report device-f3b7c91a-9be3-4173-bc7d-b7b83366f70f.remotewd.com - - 12/01/2020 20:54:46 Report	445 TCP	mssecsvc.exe PID: 2796	China
171.243.141.156	445 TCP	mssecsvc.exe PID: 2796	Viet Nam
22.190.114.199	445 TCP	mssecsvc.exe PID: 2796	United States
19.28.211.242	445 TCP	mssecsvc.exe PID: 2796	United States
51.187.114.224	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
80.93.187.33 OSINT Associated Artifacts for 80.93.187.33 Details Domain Threat Level Positives Last Resolved Reference Domain stafftool.ru Threat Level - Positives - Last Resolved 11/06/2018 00:00:49 VirusTotal Report stafftool.ru - - 11/06/2018 00:00:49 Report Domain www.stafftool.ru Threat Level - Positives - Last Resolved 11/05/2018 12:29:07 VirusTotal Report www.stafftool.ru - - 11/05/2018 12:29:07 Report Domain ns1.korot.ru Threat Level - Positives - Last Resolved 12/07/2017 00:00:00 VirusTotal Report ns1.korot.ru - - 12/07/2017 00:00:00 Report	445 TCP	mssecsvc.exe PID: 2796	Russian Federation
191.7.5.28	445 TCP	mssecsvc.exe PID: 2796	Brazil
74.66.141.75	445 TCP	mssecsvc.exe PID: 2796	United States
72.55.56.162	445 TCP	mssecsvc.exe PID: 2796	United States
182.74.141.79	445 TCP	mssecsvc.exe PID: 2796	India
66.120.107.41	445 TCP	mssecsvc.exe PID: 2796	United States
112.61.249.78	445 TCP	mssecsvc.exe PID: 2796	China
159.170.228.202	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
41.61.70.132 OSINT Associated Artifacts for 41.61.70.132 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 bb385af7c73c5dc719c7626b70d66edf2d6c5c6fd58524c256f882c1a85a295c Threat Level no verdict Positives - Scan Date 07/11/2019 15:34:03 Reference AlienVault bb385af7c73c5dc719c7626b70d66edf2d6c5c6fd58524c256f882c1a85a295c no verdict - 07/11/2019 15:34:03 AlienVault	445 TCP	mssecsvc.exe PID: 2796	South Africa
161.154.238.120	445 TCP	mssecsvc.exe PID: 2796	United States
207.194.34.20	445 TCP	mssecsvc.exe PID: 2796	Canada
207.27.9.151	445 TCP	mssecsvc.exe PID: 2796	United States
47.143.47.147	445 TCP	mssecsvc.exe PID: 2796	United States
106.131.54.225	445 TCP	mssecsvc.exe PID: 2796	Japan
107.242.149.59	445 TCP	mssecsvc.exe PID: 2796	United States
217.13.101.25	445 TCP	mssecsvc.exe PID: 2796	Hungary
76.213.129.127	445 TCP	mssecsvc.exe PID: 2796	United States
173.195.61.95	445 TCP	mssecsvc.exe PID: 2796	Canada
194.161.250.7	445 TCP	mssecsvc.exe PID: 2796	European Union
179.132.209.251	445 TCP	mssecsvc.exe PID: 2796	Brazil
119.41.65.55	445 TCP	mssecsvc.exe PID: 2796	China
123.207.207.49	445 TCP	mssecsvc.exe PID: 2796	China
182.123.146.74	445 TCP	mssecsvc.exe PID: 2796	China
166.143.60.197	445 TCP	mssecsvc.exe PID: 2796	United States
8.183.237.58	445 TCP	mssecsvc.exe PID: 2796	Singapore
196.159.127.253	445 TCP	mssecsvc.exe PID: 2796	Egypt
24.206.110.237	445 TCP	mssecsvc.exe PID: 2796	United States
205.204.80.185	445 TCP	mssecsvc.exe PID: 2796	Canada
178.44.187.56	445 TCP	mssecsvc.exe PID: 2796	Russian Federation
6.62.55.141	445 TCP	mssecsvc.exe PID: 2796	United States
123.73.18.71	445 TCP	mssecsvc.exe PID: 2796	China
48.176.16.64	445 TCP	mssecsvc.exe PID: 2796	United States
182.246.170.236	445 TCP	mssecsvc.exe PID: 2796	China
79.185.149.218	445 TCP	mssecsvc.exe PID: 2796	Poland
138.164.237.136	445 TCP	mssecsvc.exe PID: 2796	United States
150.39.244.139	445 TCP	mssecsvc.exe PID: 2796	Japan
199.20.197.248	445 TCP	mssecsvc.exe PID: 2796	United States
158.27.128.156	445 TCP	mssecsvc.exe PID: 2796	United States
162.233.214.219	445 TCP	mssecsvc.exe PID: 2796	United States
68.114.146.105	445 TCP	mssecsvc.exe PID: 2796	United States
14.192.199.144	445 TCP	mssecsvc.exe PID: 2796	Malaysia
92.132.164.37	445 TCP	mssecsvc.exe PID: 2796	France
197.77.19.144	445 TCP	mssecsvc.exe PID: 2796	South Africa
168.51.254.185	445 TCP	mssecsvc.exe PID: 2796	United States
115.132.169.116	445 TCP	mssecsvc.exe PID: 2796	Malaysia
22.207.143.80	445 TCP	mssecsvc.exe PID: 2796	United States
73.222.133.168	445 TCP	mssecsvc.exe PID: 2796	United States
14.39.195.190	445 TCP	mssecsvc.exe PID: 2796	Korea, Republic of
166.148.83.177	445 TCP	mssecsvc.exe PID: 2796	United States
41.138.52.241	445 TCP	mssecsvc.exe PID: 2796	Niger
67.136.104.7	445 TCP	mssecsvc.exe PID: 2796	United States
192.56.221.135	445 TCP	mssecsvc.exe PID: 2796	United States
70.140.171.74	445 TCP	mssecsvc.exe PID: 2796	United States
171.178.254.1	445 TCP	mssecsvc.exe PID: 2796	United States
142.61.56.35	445 TCP	mssecsvc.exe PID: 2796	Canada
21.78.45.75	445 TCP	mssecsvc.exe PID: 2796	United States
41.69.236.118	445 TCP	mssecsvc.exe PID: 2796	Egypt
124.231.214.5	445 TCP	mssecsvc.exe PID: 2796	China
199.3.181.189	445 TCP	mssecsvc.exe PID: 2796	United States
219.171.103.238	445 TCP	mssecsvc.exe PID: 2796	Japan
25.231.166.10	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
41.58.218.222	445 TCP	mssecsvc.exe PID: 2796	Nigeria
167.82.193.216	445 TCP	mssecsvc.exe PID: 2796	United States
218.151.31.252	445 TCP	mssecsvc.exe PID: 2796	Korea, Republic of
177.21.79.234	445 TCP	mssecsvc.exe PID: 2796	Brazil
175.109.177.23	445 TCP	mssecsvc.exe PID: 2796	Japan
141.199.233.113	445 TCP	mssecsvc.exe PID: 2796	United States
163.170.170.25	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
3.183.206.81	445 TCP	mssecsvc.exe PID: 2796	United States
66.46.89.210	445 TCP	mssecsvc.exe PID: 2796	Canada
40.250.106.176	445 TCP	mssecsvc.exe PID: 2796	United States
190.17.41.250	445 TCP	mssecsvc.exe PID: 2796	Argentina
45.97.186.149	445 TCP	mssecsvc.exe PID: 2796	Egypt
29.123.148.115	445 TCP	mssecsvc.exe PID: 2796	United States
63.223.151.102	445 TCP	mssecsvc.exe PID: 2796	United States
60.194.152.87	445 TCP	mssecsvc.exe PID: 2796	China
6.197.7.241	445 TCP	mssecsvc.exe PID: 2796	United States
198.139.167.39	445 TCP	mssecsvc.exe PID: 2796	United States
139.166.141.4	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
198.42.183.66	445 TCP	mssecsvc.exe PID: 2796	United States
159.88.83.168	445 TCP	mssecsvc.exe PID: 2796	United States
176.2.154.111	445 TCP	mssecsvc.exe PID: 2796	Germany
209.103.251.88	445 TCP	mssecsvc.exe PID: 2796	United States
163.32.239.193	445 TCP	mssecsvc.exe PID: 2796	Taiwan; Republic of China (ROC)
69.129.32.84	445 TCP	mssecsvc.exe PID: 2796	United States
4.141.64.225	445 TCP	mssecsvc.exe PID: 2796	United States
94.34.41.148	445 TCP	mssecsvc.exe PID: 2796	Italy
42.253.167.22	445 TCP	mssecsvc.exe PID: 2796	China
209.199.26.128	445 TCP	mssecsvc.exe PID: 2796	United States
93.140.214.190	445 TCP	mssecsvc.exe PID: 2796	Croatia (LOCAL Name: Hrvatska)
25.17.124.147	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
190.100.254.113	445 TCP	mssecsvc.exe PID: 2796	Chile
66.196.112.108	445 TCP	mssecsvc.exe PID: 2796	United States
222.227.191.142	445 TCP	mssecsvc.exe PID: 2796	Japan
119.142.68.123	445 TCP	mssecsvc.exe PID: 2796	China
175.169.212.44	445 TCP	mssecsvc.exe PID: 2796	China
12.33.119.219	445 TCP	mssecsvc.exe PID: 2796	United States
13.216.31.33	445 TCP	mssecsvc.exe PID: 2796	United States
133.10.11.85	445 TCP	mssecsvc.exe PID: 2796	Japan
194.66.183.51	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
162.78.199.242	445 TCP	mssecsvc.exe PID: 2796	United States
141.161.208.130	445 TCP	mssecsvc.exe PID: 2796	United States
24.164.133.207	445 TCP	mssecsvc.exe PID: 2796	United States
213.209.49.194	445 TCP	mssecsvc.exe PID: 2796	Italy
2.104.244.243	445 TCP	mssecsvc.exe PID: 2796	Denmark
173.187.147.133	445 TCP	mssecsvc.exe PID: 2796	United States
53.90.73.224	445 TCP	mssecsvc.exe PID: 2796	Germany
86.174.185.177	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
33.83.135.232	445 TCP	mssecsvc.exe PID: 2796	United States
172.96.70.50	445 TCP	mssecsvc.exe PID: 2796	United States
97.1.76.127	445 TCP	mssecsvc.exe PID: 2796	United States
15.93.1.68	445 TCP	mssecsvc.exe PID: 2796	United States
201.109.19.69	445 TCP	mssecsvc.exe PID: 2796	Mexico
205.181.146.196	445 TCP	mssecsvc.exe PID: 2796	United States
102.71.140.12	445 TCP	mssecsvc.exe PID: 2796	Malawi
39.180.61.3	445 TCP	mssecsvc.exe PID: 2796	China
129.60.193.148	445 TCP	mssecsvc.exe PID: 2796	Japan
143.89.102.153	445 TCP	mssecsvc.exe PID: 2796	Hong Kong
49.220.4.153	445 TCP	mssecsvc.exe PID: 2796	China
31.244.143.113	445 TCP	mssecsvc.exe PID: 2796	Germany
63.128.206.48	445 TCP	mssecsvc.exe PID: 2796	United States
100.119.173.254	445 TCP	mssecsvc.exe PID: 2796	Reserved
167.43.4.142	445 TCP	mssecsvc.exe PID: 2796	Canada
41.221.185.19	445 TCP	mssecsvc.exe PID: 2796	Mali
138.190.153.30	445 TCP	mssecsvc.exe PID: 2796	Switzerland
43.83.31.222	445 TCP	mssecsvc.exe PID: 2796	Japan
129.30.55.76	445 TCP	mssecsvc.exe PID: 2796	United States
56.41.108.31	445 TCP	mssecsvc.exe PID: 2796	United States
82.238.194.30	445 TCP	mssecsvc.exe PID: 2796	France
103.148.115.195	445 TCP	mssecsvc.exe PID: 2796	India
171.122.164.206	445 TCP	mssecsvc.exe PID: 2796	China
51.99.246.208	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
111.199.62.151	445 TCP	mssecsvc.exe PID: 2796	China
63.120.75.103	445 TCP	mssecsvc.exe PID: 2796	United States
110.41.6.3	445 TCP	mssecsvc.exe PID: 2796	China
67.172.60.79	445 TCP	mssecsvc.exe PID: 2796	United States
129.110.153.235	445 TCP	mssecsvc.exe PID: 2796	United States
219.38.245.212	445 TCP	mssecsvc.exe PID: 2796	Japan
44.221.175.153	445 TCP	mssecsvc.exe PID: 2796	United States
25.253.228.28	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
137.172.74.191	445 TCP	mssecsvc.exe PID: 2796	Australia
169.247.176.251	445 TCP	mssecsvc.exe PID: 2796	United States
5.69.99.166	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
216.171.235.171	445 TCP	mssecsvc.exe PID: 2796	Canada
134.147.3.46	445 TCP	mssecsvc.exe PID: 2796	Germany
58.247.167.51	445 TCP	mssecsvc.exe PID: 2796	China
220.211.227.84	445 TCP	mssecsvc.exe PID: 2796	Japan
217.40.245.110	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
171.71.105.179	445 TCP	mssecsvc.exe PID: 2796	United States
101.51.227.56	445 TCP	mssecsvc.exe PID: 2796	Thailand
111.214.12.194	445 TCP	mssecsvc.exe PID: 2796	China
171.186.16.111	445 TCP	mssecsvc.exe PID: 2796	United States
215.70.181.51	445 TCP	mssecsvc.exe PID: 2796	United States
198.197.100.113	445 TCP	mssecsvc.exe PID: 2796	United States
103.217.216.2	445 TCP	mssecsvc.exe PID: 2796	Indonesia
21.221.20.28	445 TCP	mssecsvc.exe PID: 2796	United States
22.121.96.72	445 TCP	mssecsvc.exe PID: 2796	United States
84.131.8.103	445 TCP	mssecsvc.exe PID: 2796	Germany
189.147.122.220	445 TCP	mssecsvc.exe PID: 2796	Mexico
211.116.212.86	445 TCP	mssecsvc.exe PID: 2796	Korea, Republic of
125.189.136.71	445 TCP	mssecsvc.exe PID: 2796	Korea, Republic of
6.145.69.149	445 TCP	mssecsvc.exe PID: 2796	United States
184.180.214.156	445 TCP	mssecsvc.exe PID: 2796	United States
168.68.166.98	445 TCP	mssecsvc.exe PID: 2796	United States
28.53.147.250	445 TCP	mssecsvc.exe PID: 2796	United States
96.85.93.247	445 TCP	mssecsvc.exe PID: 2796	United States
87.240.3.135	445 TCP	mssecsvc.exe PID: 2796	Russian Federation
122.118.91.73	445 TCP	mssecsvc.exe PID: 2796	Taiwan; Republic of China (ROC)
151.18.204.51	445 TCP	mssecsvc.exe PID: 2796	Italy
58.167.240.253	445 TCP	mssecsvc.exe PID: 2796	Australia
52.49.130.219	445 TCP	mssecsvc.exe PID: 2796	United States
219.107.173.0	445 TCP	mssecsvc.exe PID: 2796	Japan
67.127.154.145	445 TCP	mssecsvc.exe PID: 2796	United States
125.119.180.87	445 TCP	mssecsvc.exe PID: 2796	China
203.60.29.119	445 TCP	mssecsvc.exe PID: 2796	Hong Kong
202.51.53.82	445 TCP	mssecsvc.exe PID: 2796	Japan
123.97.232.221	445 TCP	mssecsvc.exe PID: 2796	China
145.209.97.42	445 TCP	mssecsvc.exe PID: 2796	Netherlands
171.206.197.123	445 TCP	mssecsvc.exe PID: 2796	United States
30.127.34.15	445 TCP	mssecsvc.exe PID: 2796	United States
191.146.121.157	445 TCP	mssecsvc.exe PID: 2796	Colombia
94.245.48.159	445 TCP	mssecsvc.exe PID: 2796	Sweden
107.184.68.194	445 TCP	mssecsvc.exe PID: 2796	United States
159.76.119.100	445 TCP	mssecsvc.exe PID: 2796	United States
135.122.16.53	445 TCP	mssecsvc.exe PID: 2796	United States
95.178.119.237	445 TCP	mssecsvc.exe PID: 2796	Poland
103.211.249.145	445 TCP	mssecsvc.exe PID: 2796	China
60.36.109.126	445 TCP	mssecsvc.exe PID: 2796	Japan
153.183.131.234	445 TCP	mssecsvc.exe PID: 2796	Japan
150.167.189.86	445 TCP	mssecsvc.exe PID: 2796	United States
24.151.169.3	445 TCP	mssecsvc.exe PID: 2796	United States
72.12.91.219	445 TCP	mssecsvc.exe PID: 2796	United States
19.64.196.42	445 TCP	mssecsvc.exe PID: 2796	United States
64.119.96.208	445 TCP	mssecsvc.exe PID: 2796	Canada
48.191.217.73	445 TCP	mssecsvc.exe PID: 2796	United States
90.37.147.183	445 TCP	mssecsvc.exe PID: 2796	France
80.23.155.242	445 TCP	mssecsvc.exe PID: 2796	Italy
105.80.191.139	445 TCP	mssecsvc.exe PID: 2796	Egypt
104.9.34.233	445 TCP	mssecsvc.exe PID: 2796	United States
151.178.140.70	445 TCP	mssecsvc.exe PID: 2796	Australia
87.27.96.10	445 TCP	mssecsvc.exe PID: 2796	Italy
177.152.93.200	445 TCP	mssecsvc.exe PID: 2796	Brazil
145.165.216.211	445 TCP	mssecsvc.exe PID: 2796	Netherlands
19.252.68.115	445 TCP	mssecsvc.exe PID: 2796	United States
146.46.8.244	445 TCP	mssecsvc.exe PID: 2796	United States
146.4.227.219	445 TCP	mssecsvc.exe PID: 2796	Switzerland
49.216.55.167	445 TCP	mssecsvc.exe PID: 2796	Taiwan; Republic of China (ROC)
63.29.14.206	445 TCP	mssecsvc.exe PID: 2796	United States
56.97.205.136	445 TCP	mssecsvc.exe PID: 2796	United States
142.28.223.50	445 TCP	mssecsvc.exe PID: 2796	Canada
42.220.219.170	445 TCP	mssecsvc.exe PID: 2796	China
176.22.62.67	445 TCP	mssecsvc.exe PID: 2796	Denmark
179.243.131.48	445 TCP	mssecsvc.exe PID: 2796	Brazil
184.200.210.158	445 TCP	mssecsvc.exe PID: 2796	United States
137.61.55.241	445 TCP	mssecsvc.exe PID: 2796	Sweden
206.213.61.18	445 TCP	mssecsvc.exe PID: 2796	United States
28.117.254.109	445 TCP	mssecsvc.exe PID: 2796	United States
120.173.248.155	445 TCP	mssecsvc.exe PID: 2796	Indonesia
137.164.33.128	445 TCP	mssecsvc.exe PID: 2796	United States
90.71.229.42	445 TCP	mssecsvc.exe PID: 2796	France
88.96.13.31	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
8.142.83.133	445 TCP	mssecsvc.exe PID: 2796	Singapore
181.7.118.47	445 TCP	mssecsvc.exe PID: 2796	Argentina
86.36.77.91	445 TCP	mssecsvc.exe PID: 2796	Qatar
15.4.82.100	445 TCP	mssecsvc.exe PID: 2796	United States
62.9.35.140	445 TCP	mssecsvc.exe PID: 2796	Ireland
23.91.205.89	445 TCP	mssecsvc.exe PID: 2796	United States
177.164.131.226	445 TCP	mssecsvc.exe PID: 2796	Brazil
217.218.178.167	445 TCP	mssecsvc.exe PID: 2796	Iran (ISLAMIC Republic Of)
138.160.245.223	445 TCP	mssecsvc.exe PID: 2796	United States
80.207.186.131	445 TCP	mssecsvc.exe PID: 2796	Italy
7.233.245.115	445 TCP	mssecsvc.exe PID: 2796	United States
19.21.113.189	445 TCP	mssecsvc.exe PID: 2796	United States
88.100.9.246	445 TCP	mssecsvc.exe PID: 2796	Czech Republic
200.233.204.5	445 TCP	mssecsvc.exe PID: 2796	Brazil
163.11.127.3	445 TCP	mssecsvc.exe PID: 2796	United States
5.83.117.32	445 TCP	mssecsvc.exe PID: 2796	United Arab Emirates
164.198.252.72	445 TCP	mssecsvc.exe PID: 2796	United States
131.47.2.212	445 TCP	mssecsvc.exe PID: 2796	United States
212.79.81.155	445 TCP	mssecsvc.exe PID: 2796	Belgium
107.106.233.222	445 TCP	mssecsvc.exe PID: 2796	United States
99.137.46.36	445 TCP	mssecsvc.exe PID: 2796	United States
13.181.175.42	445 TCP	mssecsvc.exe PID: 2796	United States
126.245.8.25	445 TCP	mssecsvc.exe PID: 2796	Japan
108.174.101.128	445 TCP	mssecsvc.exe PID: 2796	United States
47.18.227.141	445 TCP	mssecsvc.exe PID: 2796	United States
90.120.80.90	445 TCP	mssecsvc.exe PID: 2796	France
179.228.191.132	445 TCP	mssecsvc.exe PID: 2796	Brazil
124.134.132.175	445 TCP	mssecsvc.exe PID: 2796	China
76.16.55.110	445 TCP	mssecsvc.exe PID: 2796	United States
200.143.146.246	445 TCP	mssecsvc.exe PID: 2796	Brazil
99.143.64.244	445 TCP	mssecsvc.exe PID: 2796	United States
30.82.110.32	445 TCP	mssecsvc.exe PID: 2796	United States
180.31.207.85	445 TCP	mssecsvc.exe PID: 2796	Japan
143.208.187.168	445 TCP	mssecsvc.exe PID: 2796	Brazil
162.234.121.65	445 TCP	mssecsvc.exe PID: 2796	United States
131.164.66.172	445 TCP	mssecsvc.exe PID: 2796	Denmark
27.110.214.24	445 TCP	mssecsvc.exe PID: 2796	Philippines
204.204.179.95	445 TCP	mssecsvc.exe PID: 2796	United States
139.125.47.241	445 TCP	mssecsvc.exe PID: 2796	United States
17.132.113.106	445 TCP	mssecsvc.exe PID: 2796	United States
187.20.203.71	445 TCP	mssecsvc.exe PID: 2796	Brazil
13.116.196.183	445 TCP	mssecsvc.exe PID: 2796	United States
35.228.40.105	445 TCP	mssecsvc.exe PID: 2796	United States
144.197.147.195	445 TCP	mssecsvc.exe PID: 2796	United States
85.143.117.117	445 TCP	mssecsvc.exe PID: 2796	Russian Federation
186.187.182.191	445 TCP	mssecsvc.exe PID: 2796	Venezuela
28.249.68.94	445 TCP	mssecsvc.exe PID: 2796	United States
74.218.193.2	445 TCP	mssecsvc.exe PID: 2796	United States
130.38.105.113	445 TCP	mssecsvc.exe PID: 2796	United States
17.175.17.197	445 TCP	mssecsvc.exe PID: 2796	United States
193.51.165.251	445 TCP	mssecsvc.exe PID: 2796	France
161.135.213.210	445 TCP	mssecsvc.exe PID: 2796	United States
69.125.97.222	445 TCP	mssecsvc.exe PID: 2796	United States
169.4.76.247	445 TCP	mssecsvc.exe PID: 2796	United States
217.185.14.174	445 TCP	mssecsvc.exe PID: 2796	Germany
91.8.171.116	445 TCP	mssecsvc.exe PID: 2796	Germany
222.190.28.78	445 TCP	mssecsvc.exe PID: 2796	China
137.40.234.53	445 TCP	mssecsvc.exe PID: 2796	United States
9.129.41.193	445 TCP	mssecsvc.exe PID: 2796	United States
182.46.87.67	445 TCP	mssecsvc.exe PID: 2796	China
108.32.184.40	445 TCP	mssecsvc.exe PID: 2796	United States
36.122.160.18	445 TCP	mssecsvc.exe PID: 2796	China
181.187.210.242	445 TCP	mssecsvc.exe PID: 2796	Venezuela
7.128.218.207	445 TCP	mssecsvc.exe PID: 2796	United States
180.87.136.117	445 TCP	mssecsvc.exe PID: 2796	India
46.236.7.93	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
90.55.27.101	445 TCP	mssecsvc.exe PID: 2796	France
86.38.166.93	445 TCP	mssecsvc.exe PID: 2796	Lithuania
55.123.209.66	445 TCP	mssecsvc.exe PID: 2796	United States
100.202.37.208	445 TCP	mssecsvc.exe PID: 2796	United States
120.151.109.170	445 TCP	mssecsvc.exe PID: 2796	Australia
62.235.138.148	445 TCP	mssecsvc.exe PID: 2796	Belgium
201.12.205.205	445 TCP	mssecsvc.exe PID: 2796	Brazil
55.115.206.96	445 TCP	mssecsvc.exe PID: 2796	United States
200.22.204.134	445 TCP	mssecsvc.exe PID: 2796	Chile
15.19.195.225	445 TCP	mssecsvc.exe PID: 2796	United States
178.195.135.51	445 TCP	mssecsvc.exe PID: 2796	Switzerland
214.75.171.170	445 TCP	mssecsvc.exe PID: 2796	United States
220.207.131.105	445 TCP	mssecsvc.exe PID: 2796	China
175.80.24.228	445 TCP	mssecsvc.exe PID: 2796	China
219.203.146.42	445 TCP	mssecsvc.exe PID: 2796	Japan
30.163.11.246	445 TCP	mssecsvc.exe PID: 2796	United States
152.52.152.47	445 TCP	mssecsvc.exe PID: 2796	India
203.138.50.205	445 TCP	mssecsvc.exe PID: 2796	Japan
223.143.99.78	445 TCP	mssecsvc.exe PID: 2796	Taiwan; Republic of China (ROC)
47.54.208.64	445 TCP	mssecsvc.exe PID: 2796	Canada
173.165.20.6	445 TCP	mssecsvc.exe PID: 2796	United States
145.226.148.188	445 TCP	mssecsvc.exe PID: 2796	France
19.1.183.70	445 TCP	mssecsvc.exe PID: 2796	United States
38.79.248.43	445 TCP	mssecsvc.exe PID: 2796	United States
99.8.241.254	445 TCP	mssecsvc.exe PID: 2796	United States
208.230.48.13	445 TCP	mssecsvc.exe PID: 2796	United States
196.126.206.144	445 TCP	mssecsvc.exe PID: 2796	Morocco
52.224.206.148	445 TCP	mssecsvc.exe PID: 2796	United States
116.175.229.186	445 TCP	mssecsvc.exe PID: 2796	China
219.166.34.23	445 TCP	mssecsvc.exe PID: 2796	Japan
219.80.85.23	445 TCP	mssecsvc.exe PID: 2796	Taiwan; Republic of China (ROC)
74.249.57.24	445 TCP	mssecsvc.exe PID: 2796	United States
130.212.178.94	445 TCP	mssecsvc.exe PID: 2796	United States
102.111.56.40	445 TCP	mssecsvc.exe PID: 2796	Tunisia
47.111.120.34	445 TCP	mssecsvc.exe PID: 2796	China
76.78.115.156	445 TCP	mssecsvc.exe PID: 2796	United States
133.115.130.151	445 TCP	mssecsvc.exe PID: 2796	Japan
182.138.76.128	445 TCP	mssecsvc.exe PID: 2796	China
190.242.122.139	445 TCP	mssecsvc.exe PID: 2796	Colombia
73.157.152.143	445 TCP	mssecsvc.exe PID: 2796	United States
178.245.161.123	445 TCP	mssecsvc.exe PID: 2796	Turkey
211.118.172.167	445 TCP	mssecsvc.exe PID: 2796	Korea, Republic of
152.204.129.26	445 TCP	mssecsvc.exe PID: 2796	Colombia
74.58.27.136	445 TCP	mssecsvc.exe PID: 2796	Canada
16.161.149.7	445 TCP	mssecsvc.exe PID: 2796	United States
116.118.43.228	445 TCP	mssecsvc.exe PID: 2796	Viet Nam
173.196.253.120	445 TCP	mssecsvc.exe PID: 2796	United States
133.224.219.248	445 TCP	mssecsvc.exe PID: 2796	Japan
192.99.134.253	445 TCP	mssecsvc.exe PID: 2796	Canada
94.123.240.134	445 TCP	mssecsvc.exe PID: 2796	Turkey
210.137.229.163	445 TCP	mssecsvc.exe PID: 2796	Japan
37.218.65.185	445 TCP	mssecsvc.exe PID: 2796	Spain
32.228.131.48	445 TCP	mssecsvc.exe PID: 2796	United States
204.227.188.52	445 TCP	mssecsvc.exe PID: 2796	United States
124.120.160.195	445 TCP	mssecsvc.exe PID: 2796	Thailand
91.234.187.188	445 TCP	mssecsvc.exe PID: 2796	Poland
21.201.198.139	445 TCP	mssecsvc.exe PID: 2796	United States
84.11.230.99	445 TCP	mssecsvc.exe PID: 2796	Germany
197.202.194.133	445 TCP	mssecsvc.exe PID: 2796	Algeria
121.193.50.20	445 TCP	mssecsvc.exe PID: 2796	China
200.112.5.70	445 TCP	mssecsvc.exe PID: 2796	Chile
45.3.157.44	445 TCP	mssecsvc.exe PID: 2796	United States
88.179.162.203	445 TCP	mssecsvc.exe PID: 2796	France
23.36.121.112	445 TCP	mssecsvc.exe PID: 2796	United States
178.167.236.42	445 TCP	mssecsvc.exe PID: 2796	Ireland
204.246.201.194	445 TCP	mssecsvc.exe PID: 2796	United States
62.19.205.166	445 TCP	mssecsvc.exe PID: 2796	Italy
113.86.226.221	445 TCP	mssecsvc.exe PID: 2796	China
183.17.229.0	445 TCP	mssecsvc.exe PID: 2796	China
205.80.242.193	445 TCP	mssecsvc.exe PID: 2796	United States
154.4.87.52	445 TCP	mssecsvc.exe PID: 2796	United States
115.185.150.30	445 TCP	mssecsvc.exe PID: 2796	India
65.179.190.126	445 TCP	mssecsvc.exe PID: 2796	United States
145.165.57.38	445 TCP	mssecsvc.exe PID: 2796	Netherlands
213.134.17.22	445 TCP	mssecsvc.exe PID: 2796	Hungary
186.117.55.192	445 TCP	mssecsvc.exe PID: 2796	Colombia
11.173.237.152	445 TCP	mssecsvc.exe PID: 2796	United States
161.242.115.227	445 TCP	mssecsvc.exe PID: 2796	United States
135.214.65.60	445 TCP	mssecsvc.exe PID: 2796	United States
207.156.90.150	445 TCP	mssecsvc.exe PID: 2796	United States
144.246.215.170	445 TCP	mssecsvc.exe PID: 2796	United States
5.123.134.228	445 TCP	mssecsvc.exe PID: 2796	Iran (ISLAMIC Republic Of)
154.24.19.230	445 TCP	mssecsvc.exe PID: 2796	United States
129.22.131.57	445 TCP	mssecsvc.exe PID: 2796	United States
40.33.94.98	445 TCP	mssecsvc.exe PID: 2796	United States
17.176.99.38	445 TCP	mssecsvc.exe PID: 2796	United States
3.66.37.228	445 TCP	mssecsvc.exe PID: 2796	United States
67.187.14.226	445 TCP	mssecsvc.exe PID: 2796	United States
113.233.172.208	445 TCP	mssecsvc.exe PID: 2796	China
179.45.68.227	445 TCP	mssecsvc.exe PID: 2796	Venezuela
162.107.182.181	445 TCP	mssecsvc.exe PID: 2796	United States
78.185.10.124	445 TCP	mssecsvc.exe PID: 2796	Turkey
70.88.142.22	445 TCP	mssecsvc.exe PID: 2796	United States
72.54.93.222	445 TCP	mssecsvc.exe PID: 2796	United States
187.51.83.40	445 TCP	mssecsvc.exe PID: 2796	Brazil
100.107.74.93	445 TCP	mssecsvc.exe PID: 2796	Reserved
147.7.181.28	445 TCP	mssecsvc.exe PID: 2796	Hungary
182.22.85.137	445 TCP	mssecsvc.exe PID: 2796	Japan
47.110.158.253	445 TCP	mssecsvc.exe PID: 2796	China
112.24.17.211	445 TCP	mssecsvc.exe PID: 2796	China
201.214.193.99	445 TCP	mssecsvc.exe PID: 2796	Chile
53.95.227.49	445 TCP	mssecsvc.exe PID: 2796	Germany
70.25.254.30	445 TCP	mssecsvc.exe PID: 2796	Canada
33.178.51.216	445 TCP	mssecsvc.exe PID: 2796	United States
68.132.136.103	445 TCP	mssecsvc.exe PID: 2796	United States
30.89.86.151	445 TCP	mssecsvc.exe PID: 2796	United States
148.26.103.0	445 TCP	mssecsvc.exe PID: 2796	United States
86.194.182.82	445 TCP	mssecsvc.exe PID: 2796	France
183.163.234.136	445 TCP	mssecsvc.exe PID: 2796	China
180.199.92.93	445 TCP	mssecsvc.exe PID: 2796	Japan
118.23.153.139	445 TCP	mssecsvc.exe PID: 2796	Japan
162.81.46.225	445 TCP	mssecsvc.exe PID: 2796	United States
173.33.96.92	445 TCP	mssecsvc.exe PID: 2796	Canada
59.59.173.21	445 TCP	mssecsvc.exe PID: 2796	China
12.64.66.61	445 TCP	mssecsvc.exe PID: 2796	United States
134.240.228.38	445 TCP	mssecsvc.exe PID: 2796	United States
219.9.144.70	445 TCP	mssecsvc.exe PID: 2796	Japan
2.114.150.245	445 TCP	mssecsvc.exe PID: 2796	Italy
95.28.175.9	445 TCP	mssecsvc.exe PID: 2796	Russian Federation
142.240.149.75	445 TCP	mssecsvc.exe PID: 2796	Canada
107.212.98.31	445 TCP	mssecsvc.exe PID: 2796	United States
70.161.98.178	445 TCP	mssecsvc.exe PID: 2796	United States
120.185.173.194	445 TCP	mssecsvc.exe PID: 2796	Indonesia
82.25.212.205	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
77.189.106.71	445 TCP	mssecsvc.exe PID: 2796	Germany
73.132.200.30	445 TCP	mssecsvc.exe PID: 2796	United States
101.134.154.159	445 TCP	mssecsvc.exe PID: 2796	China
23.121.10.221	445 TCP	mssecsvc.exe PID: 2796	United States
15.82.220.218	445 TCP	mssecsvc.exe PID: 2796	United States
121.176.234.23	445 TCP	mssecsvc.exe PID: 2796	Korea, Republic of
220.24.240.68	445 TCP	mssecsvc.exe PID: 2796	Japan
147.135.203.248	445 TCP	mssecsvc.exe PID: 2796	France
187.186.190.231	445 TCP	mssecsvc.exe PID: 2796	Mexico
35.252.92.107	445 TCP	mssecsvc.exe PID: 2796	United States
110.176.205.179	445 TCP	mssecsvc.exe PID: 2796	China
29.175.246.64	445 TCP	mssecsvc.exe PID: 2796	United States
41.103.111.41	445 TCP	mssecsvc.exe PID: 2796	Algeria
137.229.178.197	445 TCP	mssecsvc.exe PID: 2796	United States
196.209.63.140	445 TCP	mssecsvc.exe PID: 2796	South Africa
175.111.61.217	445 TCP	mssecsvc.exe PID: 2796	Taiwan; Republic of China (ROC)
126.197.19.79	445 TCP	mssecsvc.exe PID: 2796	Japan
164.49.190.208	445 TCP	mssecsvc.exe PID: 2796	United States
209.131.72.61	445 TCP	mssecsvc.exe PID: 2796	United States
55.203.206.220	445 TCP	mssecsvc.exe PID: 2796	United States
133.108.67.217	445 TCP	mssecsvc.exe PID: 2796	Japan
7.106.240.156	445 TCP	mssecsvc.exe PID: 2796	United States
61.2.124.205	445 TCP	mssecsvc.exe PID: 2796	India
171.197.76.197	445 TCP	mssecsvc.exe PID: 2796	United States
53.149.140.83	445 TCP	mssecsvc.exe PID: 2796	Germany
144.236.53.6	445 TCP	mssecsvc.exe PID: 2796	United States
107.100.199.44	445 TCP	mssecsvc.exe PID: 2796	United States
208.101.153.146	445 TCP	mssecsvc.exe PID: 2796	United States
138.221.146.244	445 TCP	mssecsvc.exe PID: 2796	Switzerland
72.31.127.28	445 TCP	mssecsvc.exe PID: 2796	United States
68.246.61.207	445 TCP	mssecsvc.exe PID: 2796	United States
207.51.158.85	445 TCP	mssecsvc.exe PID: 2796	United States
187.193.93.244	445 TCP	mssecsvc.exe PID: 2796	Mexico
130.199.96.214	445 TCP	mssecsvc.exe PID: 2796	United States
72.43.51.119	445 TCP	mssecsvc.exe PID: 2796	United States
113.174.111.10	445 TCP	mssecsvc.exe PID: 2796	Viet Nam
111.189.151.140	445 TCP	mssecsvc.exe PID: 2796	Japan
130.224.16.18	445 TCP	mssecsvc.exe PID: 2796	United States
213.64.228.117	445 TCP	mssecsvc.exe PID: 2796	Sweden
148.56.63.42	445 TCP	mssecsvc.exe PID: 2796	Spain
112.65.146.107	445 TCP	mssecsvc.exe PID: 2796	China
215.17.63.79	445 TCP	mssecsvc.exe PID: 2796	United States
153.161.246.103	445 TCP	mssecsvc.exe PID: 2796	Japan
218.183.239.159	445 TCP	mssecsvc.exe PID: 2796	Japan
221.160.76.169	445 TCP	mssecsvc.exe PID: 2796	Korea, Republic of
16.184.221.195	445 TCP	mssecsvc.exe PID: 2796	United States
172.120.144.249	445 TCP	mssecsvc.exe PID: 2796	United States
154.252.82.192	445 TCP	mssecsvc.exe PID: 2796	Algeria
7.106.11.197	445 TCP	mssecsvc.exe PID: 2796	United States
38.30.15.168	445 TCP	mssecsvc.exe PID: 2796	United States
142.134.205.82	445 TCP	mssecsvc.exe PID: 2796	Canada
109.240.158.9	445 TCP	mssecsvc.exe PID: 2796	Finland
222.104.180.182	445 TCP	mssecsvc.exe PID: 2796	Korea, Republic of
135.105.117.41	445 TCP	mssecsvc.exe PID: 2796	United States
80.188.140.166	445 TCP	mssecsvc.exe PID: 2796	Czech Republic
13.25.122.157	445 TCP	mssecsvc.exe PID: 2796	United States
52.28.26.249	445 TCP	mssecsvc.exe PID: 2796	United States
23.113.18.147	445 TCP	mssecsvc.exe PID: 2796	United States
42.36.253.45	445 TCP	mssecsvc.exe PID: 2796	Korea, Republic of
101.241.191.168	445 TCP	mssecsvc.exe PID: 2796	China
146.63.85.62	445 TCP	mssecsvc.exe PID: 2796	United States
40.143.104.5	445 TCP	mssecsvc.exe PID: 2796	United States
195.160.250.38	445 TCP	mssecsvc.exe PID: 2796	Germany
223.95.133.132	445 TCP	mssecsvc.exe PID: 2796	China
93.112.235.184	445 TCP	mssecsvc.exe PID: 2796	Saudi Arabia
55.121.135.198	445 TCP	mssecsvc.exe PID: 2796	United States
174.192.212.91	445 TCP	mssecsvc.exe PID: 2796	United States
131.164.156.182	445 TCP	mssecsvc.exe PID: 2796	Denmark
21.54.102.88	445 TCP	mssecsvc.exe PID: 2796	United States
143.115.111.136	445 TCP	mssecsvc.exe PID: 2796	United States
46.0.229.46	445 TCP	mssecsvc.exe PID: 2796	Russian Federation
190.205.89.43	445 TCP	mssecsvc.exe PID: 2796	Venezuela
90.135.215.96	445 TCP	mssecsvc.exe PID: 2796	Sweden
18.36.41.11	445 TCP	mssecsvc.exe PID: 2796	United States
94.56.164.142	445 TCP	mssecsvc.exe PID: 2796	United Arab Emirates
222.254.236.117	445 TCP	mssecsvc.exe PID: 2796	Viet Nam
37.250.115.208	445 TCP	mssecsvc.exe PID: 2796	Sweden
178.59.59.230	445 TCP	mssecsvc.exe PID: 2796	Greece
47.68.57.82	445 TCP	mssecsvc.exe PID: 2796	United States
53.21.79.204	445 TCP	mssecsvc.exe PID: 2796	Germany
15.192.171.221	445 TCP	mssecsvc.exe PID: 2796	United States
85.99.7.167	445 TCP	mssecsvc.exe PID: 2796	Turkey
3.107.114.150	445 TCP	mssecsvc.exe PID: 2796	United States
101.100.133.3	445 TCP	mssecsvc.exe PID: 2796	New Zealand
99.104.16.117	445 TCP	mssecsvc.exe PID: 2796	United States
200.64.197.102	445 TCP	mssecsvc.exe PID: 2796	Mexico
195.46.196.137	445 TCP	mssecsvc.exe PID: 2796	France
20.125.163.210	445 TCP	mssecsvc.exe PID: 2796	United States
110.97.188.30	445 TCP	mssecsvc.exe PID: 2796	China
201.101.84.129	445 TCP	mssecsvc.exe PID: 2796	Mexico
142.142.16.133	445 TCP	mssecsvc.exe PID: 2796	Canada
210.31.203.71	445 TCP	mssecsvc.exe PID: 2796	China
212.214.167.116	445 TCP	mssecsvc.exe PID: 2796	Sweden
210.79.63.110	445 TCP	mssecsvc.exe PID: 2796	Hong Kong
131.181.214.249	445 TCP	mssecsvc.exe PID: 2796	Australia
42.206.6.62	445 TCP	mssecsvc.exe PID: 2796	China
101.159.121.134	445 TCP	mssecsvc.exe PID: 2796	China
219.132.231.39	445 TCP	mssecsvc.exe PID: 2796	China
50.156.99.92	445 TCP	mssecsvc.exe PID: 2796	United States
140.204.249.46	445 TCP	mssecsvc.exe PID: 2796	United States
42.177.229.67	445 TCP	mssecsvc.exe PID: 2796	China
81.57.195.67	445 TCP	mssecsvc.exe PID: 2796	France
61.50.149.185	445 TCP	mssecsvc.exe PID: 2796	China
164.184.71.169	445 TCP	mssecsvc.exe PID: 2796	United States
122.4.204.122	445 TCP	mssecsvc.exe PID: 2796	China
25.22.174.117	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
45.184.197.167	445 TCP	mssecsvc.exe PID: 2796	Argentina
21.70.29.41	445 TCP	mssecsvc.exe PID: 2796	United States
196.9.0.136	445 TCP	mssecsvc.exe PID: 2796	South Africa
209.107.71.98	445 TCP	mssecsvc.exe PID: 2796	United States
36.26.112.107	445 TCP	mssecsvc.exe PID: 2796	China
43.191.92.217	445 TCP	mssecsvc.exe PID: 2796	Japan
214.7.117.198	445 TCP	mssecsvc.exe PID: 2796	United States
195.55.171.219	445 TCP	mssecsvc.exe PID: 2796	Spain
6.115.149.160	445 TCP	mssecsvc.exe PID: 2796	United States
203.249.89.152	445 TCP	mssecsvc.exe PID: 2796	Korea, Republic of
139.161.87.192	445 TCP	mssecsvc.exe PID: 2796	United States
112.143.232.177	445 TCP	mssecsvc.exe PID: 2796	Thailand
198.252.205.191	445 TCP	mssecsvc.exe PID: 2796	United States
35.77.70.185	445 TCP	mssecsvc.exe PID: 2796	United States
106.62.58.25	445 TCP	mssecsvc.exe PID: 2796	China
4.198.216.176	445 TCP	mssecsvc.exe PID: 2796	United States
162.13.211.65	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
84.118.220.200	445 TCP	mssecsvc.exe PID: 2796	Netherlands
169.80.136.125	445 TCP	mssecsvc.exe PID: 2796	United States
192.228.253.33	445 TCP	mssecsvc.exe PID: 2796	Malaysia
39.106.74.219	445 TCP	mssecsvc.exe PID: 2796	China
53.106.81.3	445 TCP	mssecsvc.exe PID: 2796	Germany
176.89.236.20	445 TCP	mssecsvc.exe PID: 2796	Turkey
60.28.7.232	445 TCP	mssecsvc.exe PID: 2796	China
61.68.198.135	445 TCP	mssecsvc.exe PID: 2796	Australia
33.90.226.175	445 TCP	mssecsvc.exe PID: 2796	United States
160.245.30.82	445 TCP	mssecsvc.exe PID: 2796	Japan
110.220.165.165	445 TCP	mssecsvc.exe PID: 2796	China
147.125.131.2	445 TCP	mssecsvc.exe PID: 2796	Austria
208.238.141.187	445 TCP	mssecsvc.exe PID: 2796	United States
3.152.68.45	445 TCP	mssecsvc.exe PID: 2796	United States
76.171.87.103	445 TCP	mssecsvc.exe PID: 2796	United States
113.200.186.248	445 TCP	mssecsvc.exe PID: 2796	China
97.145.45.149	445 TCP	mssecsvc.exe PID: 2796	United States
56.233.157.23	445 TCP	mssecsvc.exe PID: 2796	United States
32.216.74.64	445 TCP	mssecsvc.exe PID: 2796	United States
179.17.120.21	445 TCP	mssecsvc.exe PID: 2796	Brazil
38.117.202.78	445 TCP	mssecsvc.exe PID: 2796	United States
135.145.207.96	445 TCP	mssecsvc.exe PID: 2796	United States
217.31.173.202	445 TCP	mssecsvc.exe PID: 2796	Sweden
129.179.179.226	445 TCP	mssecsvc.exe PID: 2796	United States
148.201.210.125	445 TCP	mssecsvc.exe PID: 2796	Mexico
177.183.63.175	445 TCP	mssecsvc.exe PID: 2796	Brazil
163.191.28.61	445 TCP	mssecsvc.exe PID: 2796	United States
134.174.226.155	445 TCP	mssecsvc.exe PID: 2796	United States
105.68.130.231	445 TCP	mssecsvc.exe PID: 2796	Morocco
213.230.44.235	445 TCP	mssecsvc.exe PID: 2796	Switzerland
206.20.161.87	445 TCP	mssecsvc.exe PID: 2796	United States
208.149.37.93	445 TCP	mssecsvc.exe PID: 2796	United States
48.55.237.15	445 TCP	mssecsvc.exe PID: 2796	United States
36.122.218.17	445 TCP	mssecsvc.exe PID: 2796	China
133.227.7.227	445 TCP	mssecsvc.exe PID: 2796	Japan
163.191.28.1	445 TCP	mssecsvc.exe PID: 2796	United States
20.114.167.213	445 TCP	mssecsvc.exe PID: 2796	United States
31.56.8.194	445 TCP	mssecsvc.exe PID: 2796	Iran (ISLAMIC Republic Of)
110.170.246.57	445 TCP	mssecsvc.exe PID: 2796	Thailand
7.171.3.66	445 TCP	mssecsvc.exe PID: 2796	United States
202.63.29.48	445 TCP	mssecsvc.exe PID: 2796	Hong Kong
101.198.242.18	445 TCP	mssecsvc.exe PID: 2796	China
125.77.145.131	445 TCP	mssecsvc.exe PID: 2796	China
144.39.169.157	445 TCP	mssecsvc.exe PID: 2796	United States
68.42.67.69	445 TCP	mssecsvc.exe PID: 2796	United States
181.113.55.148	445 TCP	mssecsvc.exe PID: 2796	Ecuador
93.133.23.65	445 TCP	mssecsvc.exe PID: 2796	Germany
26.29.135.131	445 TCP	mssecsvc.exe PID: 2796	United States
7.145.92.141	445 TCP	mssecsvc.exe PID: 2796	United States
181.203.26.66	445 TCP	mssecsvc.exe PID: 2796	Chile
168.222.1.189	445 TCP	mssecsvc.exe PID: 2796	United States
180.182.226.56	445 TCP	mssecsvc.exe PID: 2796	Korea, Republic of
102.193.88.165	445 TCP	mssecsvc.exe PID: 2796	Egypt
37.5.8.137	445 TCP	mssecsvc.exe PID: 2796	Germany
195.132.57.8	445 TCP	mssecsvc.exe PID: 2796	France
140.52.249.120	445 TCP	mssecsvc.exe PID: 2796	United States
146.124.82.42	445 TCP	mssecsvc.exe PID: 2796	Greece
204.209.86.157	445 TCP	mssecsvc.exe PID: 2796	Canada
18.154.241.235	445 TCP	mssecsvc.exe PID: 2796	United States
170.86.193.126	445 TCP	mssecsvc.exe PID: 2796	United States
53.11.155.92	445 TCP	mssecsvc.exe PID: 2796	Germany
137.185.229.94	445 TCP	mssecsvc.exe PID: 2796	United States
208.66.41.77	445 TCP	mssecsvc.exe PID: 2796	United States
183.172.6.208	445 TCP	mssecsvc.exe PID: 2796	China
196.167.197.63	445 TCP	mssecsvc.exe PID: 2796	South Africa
165.18.17.70	445 TCP	mssecsvc.exe PID: 2796	South Africa
149.89.11.9	445 TCP	mssecsvc.exe PID: 2796	United States
32.44.130.35	445 TCP	mssecsvc.exe PID: 2796	United States
61.121.170.230	445 TCP	mssecsvc.exe PID: 2796	Japan
122.195.153.176	445 TCP	mssecsvc.exe PID: 2796	China
96.15.202.70	445 TCP	mssecsvc.exe PID: 2796	United States
125.199.235.145	445 TCP	mssecsvc.exe PID: 2796	Japan
191.43.10.115	445 TCP	mssecsvc.exe PID: 2796	Brazil
116.125.78.172	445 TCP	mssecsvc.exe PID: 2796	Korea, Republic of
155.13.11.89	445 TCP	mssecsvc.exe PID: 2796	United States
61.71.4.10	445 TCP	mssecsvc.exe PID: 2796	Taiwan; Republic of China (ROC)
212.182.163.148	445 TCP	mssecsvc.exe PID: 2796	Netherlands
198.67.163.241	445 TCP	mssecsvc.exe PID: 2796	United States
141.134.204.145	445 TCP	mssecsvc.exe PID: 2796	Belgium
29.207.83.98	445 TCP	mssecsvc.exe PID: 2796	United States
108.167.35.198	445 TCP	mssecsvc.exe PID: 2796	United States
199.130.17.120	445 TCP	mssecsvc.exe PID: 2796	United States
54.32.231.26	445 TCP	mssecsvc.exe PID: 2796	United States
7.126.195.239	445 TCP	mssecsvc.exe PID: 2796	United States
142.13.207.232	445 TCP	mssecsvc.exe PID: 2796	Canada
187.70.204.39	445 TCP	mssecsvc.exe PID: 2796	Brazil
210.56.30.204	445 TCP	mssecsvc.exe PID: 2796	Pakistan
136.27.28.214	445 TCP	mssecsvc.exe PID: 2796	United States
180.14.204.31	445 TCP	mssecsvc.exe PID: 2796	Japan
35.198.246.198	445 TCP	mssecsvc.exe PID: 2796	United States
34.233.135.145	445 TCP	mssecsvc.exe PID: 2796	United States
80.144.214.130	445 TCP	mssecsvc.exe PID: 2796	Germany
105.150.77.134	445 TCP	mssecsvc.exe PID: 2796	Morocco
110.88.29.236	445 TCP	mssecsvc.exe PID: 2796	China
73.50.198.223	445 TCP	mssecsvc.exe PID: 2796	United States
182.14.246.206	445 TCP	mssecsvc.exe PID: 2796	Indonesia
170.174.232.35	445 TCP	mssecsvc.exe PID: 2796	United States
131.75.220.243	445 TCP	mssecsvc.exe PID: 2796	United States
64.206.0.174	445 TCP	mssecsvc.exe PID: 2796	United States
190.204.184.145	445 TCP	mssecsvc.exe PID: 2796	Venezuela
193.153.222.166	445 TCP	mssecsvc.exe PID: 2796	Spain
53.195.199.52	445 TCP	mssecsvc.exe PID: 2796	Germany
52.131.55.226	445 TCP	mssecsvc.exe PID: 2796	China
177.86.146.239	445 TCP	mssecsvc.exe PID: 2796	Brazil
205.158.26.222	445 TCP	mssecsvc.exe PID: 2796	United States
123.151.185.74	445 TCP	mssecsvc.exe PID: 2796	China
28.10.204.210	445 TCP	mssecsvc.exe PID: 2796	United States
106.215.221.227	445 TCP	mssecsvc.exe PID: 2796	India
111.221.171.87	445 TCP	mssecsvc.exe PID: 2796	China
55.136.157.152	445 TCP	mssecsvc.exe PID: 2796	United States
90.156.227.232	445 TCP	mssecsvc.exe PID: 2796	Russian Federation
155.93.88.149	445 TCP	mssecsvc.exe PID: 2796	Nigeria
199.193.106.121	445 TCP	mssecsvc.exe PID: 2796	United States
112.7.125.201	445 TCP	mssecsvc.exe PID: 2796	China
69.184.231.58	445 TCP	mssecsvc.exe PID: 2796	United States
189.101.158.191	445 TCP	mssecsvc.exe PID: 2796	Brazil
26.214.20.9	445 TCP	mssecsvc.exe PID: 2796	United States
101.121.1.228	445 TCP	mssecsvc.exe PID: 2796	China
8.180.128.60	445 TCP	mssecsvc.exe PID: 2796	Singapore
143.105.78.246	445 TCP	mssecsvc.exe PID: 2796	United States
54.15.30.71	445 TCP	mssecsvc.exe PID: 2796	United States
205.158.99.210	445 TCP	mssecsvc.exe PID: 2796	United States
27.132.222.129	445 TCP	mssecsvc.exe PID: 2796	Japan
57.99.46.4	445 TCP	mssecsvc.exe PID: 2796	Belgium
141.220.154.47	445 TCP	mssecsvc.exe PID: 2796	United States
66.192.69.133	445 TCP	mssecsvc.exe PID: 2796	United States
70.183.166.80	445 TCP	mssecsvc.exe PID: 2796	United States
211.62.35.82	445 TCP	mssecsvc.exe PID: 2796	Korea, Republic of
30.114.178.62	445 TCP	mssecsvc.exe PID: 2796	United States
129.77.105.169	445 TCP	mssecsvc.exe PID: 2796	United States
194.106.77.59	445 TCP	mssecsvc.exe PID: 2796	Malta
34.21.95.80	445 TCP	mssecsvc.exe PID: 2796	United States
30.16.207.21	445 TCP	mssecsvc.exe PID: 2796	United States
107.206.39.126	445 TCP	mssecsvc.exe PID: 2796	United States
190.35.80.205	445 TCP	mssecsvc.exe PID: 2796	Panama
179.31.142.7	445 TCP	mssecsvc.exe PID: 2796	Uruguay
47.62.128.129	445 TCP	mssecsvc.exe PID: 2796	United States
18.141.174.79	445 TCP	mssecsvc.exe PID: 2796	United States
198.106.137.213	445 TCP	mssecsvc.exe PID: 2796	United States
26.241.119.107	445 TCP	mssecsvc.exe PID: 2796	United States
110.230.212.208	445 TCP	mssecsvc.exe PID: 2796	China
113.187.156.13	445 TCP	mssecsvc.exe PID: 2796	Viet Nam
100.55.118.57	445 TCP	mssecsvc.exe PID: 2796	United States
142.248.192.243	445 TCP	mssecsvc.exe PID: 2796	Canada
2.150.93.19	445 TCP	mssecsvc.exe PID: 2796	Norway
141.204.195.119	445 TCP	mssecsvc.exe PID: 2796	United States
220.244.150.246	445 TCP	mssecsvc.exe PID: 2796	Australia
204.86.216.154	445 TCP	mssecsvc.exe PID: 2796	United States
62.43.94.20	445 TCP	mssecsvc.exe PID: 2796	Spain
71.226.200.75	445 TCP	mssecsvc.exe PID: 2796	United States
207.146.229.8	445 TCP	mssecsvc.exe PID: 2796	United States
22.217.178.242	445 TCP	mssecsvc.exe PID: 2796	United States
17.9.14.102	445 TCP	mssecsvc.exe PID: 2796	United States
49.145.47.117	445 TCP	mssecsvc.exe PID: 2796	Philippines
12.82.233.196	445 TCP	mssecsvc.exe PID: 2796	United States
92.65.13.191	445 TCP	mssecsvc.exe PID: 2796	Netherlands
192.28.131.123	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
68.173.190.43	445 TCP	mssecsvc.exe PID: 2796	United States
62.164.19.100	445 TCP	mssecsvc.exe PID: 2796	European Union
41.172.83.219	445 TCP	mssecsvc.exe PID: 2796	South Africa
99.223.84.137	445 TCP	mssecsvc.exe PID: 2796	Canada
4.61.51.67	445 TCP	mssecsvc.exe PID: 2796	United States
22.216.194.194	445 TCP	mssecsvc.exe PID: 2796	United States
56.162.204.250	445 TCP	mssecsvc.exe PID: 2796	United States
209.3.223.60	445 TCP	mssecsvc.exe PID: 2796	United States
142.90.60.213	445 TCP	mssecsvc.exe PID: 2796	Canada
7.100.4.95	445 TCP	mssecsvc.exe PID: 2796	United States
105.109.74.211	445 TCP	mssecsvc.exe PID: 2796	Algeria
164.102.145.152	445 TCP	mssecsvc.exe PID: 2796	Canada
81.6.243.185	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
38.240.173.29	445 TCP	mssecsvc.exe PID: 2796	United States
188.187.104.191	445 TCP	mssecsvc.exe PID: 2796	Russian Federation
176.179.49.22	445 TCP	mssecsvc.exe PID: 2796	France
120.32.185.62	445 TCP	mssecsvc.exe PID: 2796	China
152.12.188.182	445 TCP	mssecsvc.exe PID: 2796	United States
192.60.217.48	445 TCP	mssecsvc.exe PID: 2796	United States
209.192.11.155	445 TCP	mssecsvc.exe PID: 2796	United States
153.225.108.236	445 TCP	mssecsvc.exe PID: 2796	Japan
124.23.111.233	445 TCP	mssecsvc.exe PID: 2796	China
194.213.216.79	445 TCP	mssecsvc.exe PID: 2796	Czech Republic
89.151.125.153	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
119.244.6.37	445 TCP	mssecsvc.exe PID: 2796	Japan
153.218.169.121	445 TCP	mssecsvc.exe PID: 2796	Japan
30.58.216.60	445 TCP	mssecsvc.exe PID: 2796	United States
111.104.153.96	445 TCP	mssecsvc.exe PID: 2796	Japan
106.121.129.245	445 TCP	mssecsvc.exe PID: 2796	China
64.22.170.115	445 TCP	mssecsvc.exe PID: 2796	United States
64.196.84.188	445 TCP	mssecsvc.exe PID: 2796	United States
81.22.129.107	445 TCP	mssecsvc.exe PID: 2796	Ukraine
55.75.121.125	445 TCP	mssecsvc.exe PID: 2796	United States
189.220.122.105	445 TCP	mssecsvc.exe PID: 2796	Mexico
181.98.90.213	445 TCP	mssecsvc.exe PID: 2796	Argentina
22.148.221.194	445 TCP	mssecsvc.exe PID: 2796	United States
154.153.10.190	445 TCP	mssecsvc.exe PID: 2796	Kenya
6.154.96.230	445 TCP	mssecsvc.exe PID: 2796	United States
114.207.81.132	445 TCP	mssecsvc.exe PID: 2796	Korea, Republic of
90.114.39.25	445 TCP	mssecsvc.exe PID: 2796	France
15.197.7.208	445 TCP	mssecsvc.exe PID: 2796	United States
71.206.4.244	445 TCP	mssecsvc.exe PID: 2796	United States
29.48.31.251	445 TCP	mssecsvc.exe PID: 2796	United States
96.158.211.89	445 TCP	mssecsvc.exe PID: 2796	United States
118.223.132.65	445 TCP	mssecsvc.exe PID: 2796	Korea, Republic of
197.175.26.111	445 TCP	mssecsvc.exe PID: 2796	South Africa
61.179.128.190	445 TCP	mssecsvc.exe PID: 2796	China
108.241.250.203	445 TCP	mssecsvc.exe PID: 2796	United States
145.24.46.58	445 TCP	mssecsvc.exe PID: 2796	Netherlands
111.95.45.72	445 TCP	mssecsvc.exe PID: 2796	Indonesia
198.243.146.4	445 TCP	mssecsvc.exe PID: 2796	United States
112.8.143.57	445 TCP	mssecsvc.exe PID: 2796	China
176.117.10.121	445 TCP	mssecsvc.exe PID: 2796	Russian Federation
112.243.78.207	445 TCP	mssecsvc.exe PID: 2796	China
145.105.13.194	445 TCP	mssecsvc.exe PID: 2796	Netherlands
104.56.207.17	445 TCP	mssecsvc.exe PID: 2796	United States
137.73.24.152	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
58.189.165.9	445 TCP	mssecsvc.exe PID: 2796	Japan
123.48.27.100	445 TCP	mssecsvc.exe PID: 2796	Japan
12.146.31.70	445 TCP	mssecsvc.exe PID: 2796	United States
184.197.206.219	445 TCP	mssecsvc.exe PID: 2796	United States
21.35.220.127	445 TCP	mssecsvc.exe PID: 2796	United States
117.45.227.112	445 TCP	mssecsvc.exe PID: 2796	China
26.171.140.46	445 TCP	mssecsvc.exe PID: 2796	United States
144.162.39.103	445 TCP	mssecsvc.exe PID: 2796	United States
40.30.114.252	445 TCP	mssecsvc.exe PID: 2796	United States
25.186.221.73	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
1.74.165.59	445 TCP	mssecsvc.exe PID: 2796	Japan
186.105.214.104	445 TCP	mssecsvc.exe PID: 2796	Chile
116.70.200.111	445 TCP	mssecsvc.exe PID: 2796	Japan
212.134.73.12	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
42.0.74.66	445 TCP	mssecsvc.exe PID: 2796	Taiwan; Republic of China (ROC)
48.193.18.149	445 TCP	mssecsvc.exe PID: 2796	United States
66.113.72.247	445 TCP	mssecsvc.exe PID: 2796	United States
28.194.1.105	445 TCP	mssecsvc.exe PID: 2796	United States
193.238.50.64	445 TCP	mssecsvc.exe PID: 2796	Russian Federation
126.100.14.42	445 TCP	mssecsvc.exe PID: 2796	Japan
93.149.101.109	445 TCP	mssecsvc.exe PID: 2796	Italy
121.112.147.48	445 TCP	mssecsvc.exe PID: 2796	Japan
39.151.79.60	445 TCP	mssecsvc.exe PID: 2796	China
166.233.160.165	445 TCP	mssecsvc.exe PID: 2796	United States
185.208.254.244	445 TCP	mssecsvc.exe PID: 2796	Switzerland
141.191.144.216	445 TCP	mssecsvc.exe PID: 2796	United States
92.164.142.133	445 TCP	mssecsvc.exe PID: 2796	France
55.78.71.160	445 TCP	mssecsvc.exe PID: 2796	United States
123.66.51.57	445 TCP	mssecsvc.exe PID: 2796	China
48.27.251.122	445 TCP	mssecsvc.exe PID: 2796	United States
86.170.219.160	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
76.234.24.219	445 TCP	mssecsvc.exe PID: 2796	United States
166.70.193.157	445 TCP	mssecsvc.exe PID: 2796	United States
155.139.120.224	445 TCP	mssecsvc.exe PID: 2796	United States
132.155.176.234	445 TCP	mssecsvc.exe PID: 2796	Finland
98.181.209.195	445 TCP	mssecsvc.exe PID: 2796	United States
219.125.191.159	445 TCP	mssecsvc.exe PID: 2796	Japan
159.95.112.14	445 TCP	mssecsvc.exe PID: 2796	France
189.31.253.110	445 TCP	mssecsvc.exe PID: 2796	Brazil
209.35.19.242	445 TCP	mssecsvc.exe PID: 2796	Canada
201.214.225.63	445 TCP	mssecsvc.exe PID: 2796	Chile
170.8.61.61	445 TCP	mssecsvc.exe PID: 2796	United States
194.222.216.158	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
163.191.28.2	445 TCP	mssecsvc.exe PID: 2796	United States
157.39.254.204	445 TCP	mssecsvc.exe PID: 2796	India
100.74.138.176	445 TCP	mssecsvc.exe PID: 2796	Reserved
170.209.52.166	445 TCP	mssecsvc.exe PID: 2796	United States
97.88.121.202	445 TCP	mssecsvc.exe PID: 2796	United States
24.14.41.253	445 TCP	mssecsvc.exe PID: 2796	United States
176.138.14.113	445 TCP	mssecsvc.exe PID: 2796	France
196.202.169.149	445 TCP	mssecsvc.exe PID: 2796	Kenya
42.54.158.206	445 TCP	mssecsvc.exe PID: 2796	China
40.228.169.23	445 TCP	mssecsvc.exe PID: 2796	United States
171.205.151.139	445 TCP	mssecsvc.exe PID: 2796	United States
42.193.93.172	445 TCP	mssecsvc.exe PID: 2796	China
151.150.37.104	445 TCP	mssecsvc.exe PID: 2796	United States
183.122.187.166	445 TCP	mssecsvc.exe PID: 2796	Korea, Republic of
107.149.251.69	445 TCP	mssecsvc.exe PID: 2796	United States
44.220.245.89	445 TCP	mssecsvc.exe PID: 2796	United States
107.182.249.122	445 TCP	mssecsvc.exe PID: 2796	United States
12.249.92.4	445 TCP	mssecsvc.exe PID: 2796	United States
164.172.16.240	445 TCP	mssecsvc.exe PID: 2796	United States
150.100.142.203	445 TCP	mssecsvc.exe PID: 2796	Japan
92.60.94.164	445 TCP	mssecsvc.exe PID: 2796	Russian Federation
180.3.183.125	445 TCP	mssecsvc.exe PID: 2796	Japan
170.93.114.165	445 TCP	mssecsvc.exe PID: 2796	United States
74.139.67.16	445 TCP	mssecsvc.exe PID: 2796	United States
179.176.254.151	445 TCP	mssecsvc.exe PID: 2796	Brazil
179.51.167.116	445 TCP	mssecsvc.exe PID: 2796	Costa Rica
203.171.25.68	445 TCP	mssecsvc.exe PID: 2796	Viet Nam
160.159.186.21	445 TCP	mssecsvc.exe PID: 2796	Tunisia
172.12.155.97	445 TCP	mssecsvc.exe PID: 2796	United States
88.233.154.239	445 TCP	mssecsvc.exe PID: 2796	Turkey
148.136.117.203	445 TCP	mssecsvc.exe PID: 2796	Sweden
221.125.248.182	445 TCP	mssecsvc.exe PID: 2796	Hong Kong
31.161.227.82	445 TCP	mssecsvc.exe PID: 2796	Netherlands
38.79.158.60	445 TCP	mssecsvc.exe PID: 2796	United States
125.186.161.241	445 TCP	mssecsvc.exe PID: 2796	Korea, Republic of
123.37.129.132	445 TCP	mssecsvc.exe PID: 2796	Korea, Republic of
114.192.197.80	445 TCP	mssecsvc.exe PID: 2796	Japan
164.168.195.3	445 TCP	mssecsvc.exe PID: 2796	United States
176.61.215.223	445 TCP	mssecsvc.exe PID: 2796	Slovakia (SLOVAK Republic)
192.67.83.12	445 TCP	mssecsvc.exe PID: 2796	United States
215.10.227.189	445 TCP	mssecsvc.exe PID: 2796	United States
100.102.108.194	445 TCP	mssecsvc.exe PID: 2796	Reserved
196.6.235.120	445 TCP	mssecsvc.exe PID: 2796	South Africa
5.220.98.246	445 TCP	mssecsvc.exe PID: 2796	Iran (ISLAMIC Republic Of)
36.179.171.5	445 TCP	mssecsvc.exe PID: 2796	China
133.116.102.180	445 TCP	mssecsvc.exe PID: 2796	Japan
54.104.28.180	445 TCP	mssecsvc.exe PID: 2796	United States
167.97.63.106	445 TCP	mssecsvc.exe PID: 2796	United States
186.63.197.206	445 TCP	mssecsvc.exe PID: 2796	Argentina
137.225.228.101	445 TCP	mssecsvc.exe PID: 2796	United States
123.168.250.44	445 TCP	mssecsvc.exe PID: 2796	China
54.125.112.94	445 TCP	mssecsvc.exe PID: 2796	United States
220.189.159.219	445 TCP	mssecsvc.exe PID: 2796	China
77.166.202.209	445 TCP	mssecsvc.exe PID: 2796	Netherlands
167.86.238.139	445 TCP	mssecsvc.exe PID: 2796	Saudi Arabia
29.248.211.228	445 TCP	mssecsvc.exe PID: 2796	United States
64.167.31.233	445 TCP	mssecsvc.exe PID: 2796	United States
8.153.104.125	445 TCP	mssecsvc.exe PID: 2796	Singapore
208.48.209.135	445 TCP	mssecsvc.exe PID: 2796	United States
132.165.191.7	445 TCP	mssecsvc.exe PID: 2796	France
46.91.239.251	445 TCP	mssecsvc.exe PID: 2796	Germany
198.42.174.174	445 TCP	mssecsvc.exe PID: 2796	United States
119.251.174.119	445 TCP	mssecsvc.exe PID: 2796	China
220.136.20.147	445 TCP	mssecsvc.exe PID: 2796	Taiwan; Republic of China (ROC)
195.18.47.159	445 TCP	mssecsvc.exe PID: 2796	Russian Federation
3.249.180.162	445 TCP	mssecsvc.exe PID: 2796	United States
80.96.173.23	445 TCP	mssecsvc.exe PID: 2796	Romania
45.172.171.13	445 TCP	mssecsvc.exe PID: 2796	Brazil
34.238.189.89	445 TCP	mssecsvc.exe PID: 2796	United States
184.181.191.9	445 TCP	mssecsvc.exe PID: 2796	United States
200.25.122.51	445 TCP	mssecsvc.exe PID: 2796	Colombia
128.50.149.48	445 TCP	mssecsvc.exe PID: 2796	United States
99.22.164.59	445 TCP	mssecsvc.exe PID: 2796	United States
22.53.7.170	445 TCP	mssecsvc.exe PID: 2796	United States
180.80.100.28	445 TCP	mssecsvc.exe PID: 2796	Korea, Republic of
32.123.134.188	445 TCP	mssecsvc.exe PID: 2796	United States
214.103.206.178	445 TCP	mssecsvc.exe PID: 2796	United States
30.146.221.93	445 TCP	mssecsvc.exe PID: 2796	United States
64.158.43.171	445 TCP	mssecsvc.exe PID: 2796	United States
15.249.35.122	445 TCP	mssecsvc.exe PID: 2796	United States
151.246.76.46	445 TCP	mssecsvc.exe PID: 2796	Iran (ISLAMIC Republic Of)
116.143.89.31	445 TCP	mssecsvc.exe PID: 2796	China
139.66.158.19	445 TCP	mssecsvc.exe PID: 2796	Germany
83.100.170.230	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
102.46.89.147	445 TCP	mssecsvc.exe PID: 2796	Egypt
139.164.51.17	445 TCP	mssecsvc.exe PID: 2796	Norway
101.177.29.201	445 TCP	mssecsvc.exe PID: 2796	Australia
9.191.112.128	445 TCP	mssecsvc.exe PID: 2796	United States
143.89.219.243	445 TCP	mssecsvc.exe PID: 2796	Hong Kong
210.35.129.222	445 TCP	mssecsvc.exe PID: 2796	China
78.184.93.212	445 TCP	mssecsvc.exe PID: 2796	Turkey
143.188.66.159	445 TCP	mssecsvc.exe PID: 2796	Australia
183.161.171.77	445 TCP	mssecsvc.exe PID: 2796	China
207.151.206.170	445 TCP	mssecsvc.exe PID: 2796	United States
140.203.110.189	445 TCP	mssecsvc.exe PID: 2796	Ireland
166.147.44.250	445 TCP	mssecsvc.exe PID: 2796	United States
91.249.186.214	445 TCP	mssecsvc.exe PID: 2796	Germany
149.94.108.144	445 TCP	mssecsvc.exe PID: 2796	United States
117.50.88.56	445 TCP	mssecsvc.exe PID: 2796	China
193.85.104.97	445 TCP	mssecsvc.exe PID: 2796	Czech Republic
114.239.83.69	445 TCP	mssecsvc.exe PID: 2796	China
154.181.89.233	445 TCP	mssecsvc.exe PID: 2796	Egypt
82.89.234.162	445 TCP	mssecsvc.exe PID: 2796	Italy
120.210.195.56	445 TCP	mssecsvc.exe PID: 2796	China
42.70.173.234	445 TCP	mssecsvc.exe PID: 2796	Taiwan; Republic of China (ROC)
155.140.196.193	445 TCP	mssecsvc.exe PID: 2796	France
184.104.133.232	445 TCP	mssecsvc.exe PID: 2796	United States
85.163.134.129	445 TCP	mssecsvc.exe PID: 2796	Czech Republic
70.107.107.156	445 TCP	mssecsvc.exe PID: 2796	United States
6.105.8.231	445 TCP	mssecsvc.exe PID: 2796	United States
171.136.25.55	445 TCP	mssecsvc.exe PID: 2796	United States
198.226.231.130	445 TCP	mssecsvc.exe PID: 2796	United States
200.30.141.149	445 TCP	mssecsvc.exe PID: 2796	Guatemala
97.48.114.145	445 TCP	mssecsvc.exe PID: 2796	United States
57.236.90.111	445 TCP	mssecsvc.exe PID: 2796	Belgium
206.196.250.64	445 TCP	mssecsvc.exe PID: 2796	United States
23.59.185.151	445 TCP	mssecsvc.exe PID: 2796	United States
67.129.39.62	445 TCP	mssecsvc.exe PID: 2796	United States
39.201.173.81	445 TCP	mssecsvc.exe PID: 2796	Indonesia
221.247.238.53	445 TCP	mssecsvc.exe PID: 2796	Japan
18.118.153.226	445 TCP	mssecsvc.exe PID: 2796	United States
184.224.31.162	445 TCP	mssecsvc.exe PID: 2796	United States
219.220.2.69	445 TCP	mssecsvc.exe PID: 2796	China
33.94.88.250	445 TCP	mssecsvc.exe PID: 2796	United States
15.127.81.185	445 TCP	mssecsvc.exe PID: 2796	United States
37.244.242.224	445 TCP	mssecsvc.exe PID: 2796	Croatia (LOCAL Name: Hrvatska)
220.53.233.109	445 TCP	mssecsvc.exe PID: 2796	Japan
198.180.118.197	445 TCP	mssecsvc.exe PID: 2796	United States
154.88.242.73	445 TCP	mssecsvc.exe PID: 2796	Seychelles
175.82.128.98	445 TCP	mssecsvc.exe PID: 2796	China
189.201.122.98	445 TCP	mssecsvc.exe PID: 2796	Mexico
51.141.212.234	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
159.217.154.0	445 TCP	mssecsvc.exe PID: 2796	France
177.17.3.93	445 TCP	mssecsvc.exe PID: 2796	Brazil
120.88.224.231	445 TCP	mssecsvc.exe PID: 2796	Hong Kong
203.131.44.114	445 TCP	mssecsvc.exe PID: 2796	Australia
58.122.87.126	445 TCP	mssecsvc.exe PID: 2796	Korea, Republic of
123.37.191.116	445 TCP	mssecsvc.exe PID: 2796	Korea, Republic of
164.218.132.147	445 TCP	mssecsvc.exe PID: 2796	United States
200.99.75.77	445 TCP	mssecsvc.exe PID: 2796	Brazil
2.15.62.121	445 TCP	mssecsvc.exe PID: 2796	France
78.250.3.181	445 TCP	mssecsvc.exe PID: 2796	France
87.15.138.201	445 TCP	mssecsvc.exe PID: 2796	Italy
1.8.114.212	445 TCP	mssecsvc.exe PID: 2796	China
176.251.210.185	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
53.101.102.74	445 TCP	mssecsvc.exe PID: 2796	Germany
129.124.52.49	445 TCP	mssecsvc.exe PID: 2796	United States
13.108.79.13	445 TCP	mssecsvc.exe PID: 2796	United States
203.104.162.153	445 TCP	mssecsvc.exe PID: 2796	Singapore
170.228.167.49	445 TCP	mssecsvc.exe PID: 2796	United States
210.226.119.5	445 TCP	mssecsvc.exe PID: 2796	Japan
165.99.238.0	445 TCP	mssecsvc.exe PID: 2796	Nicaragua
99.192.58.100	445 TCP	mssecsvc.exe PID: 2796	Canada
111.38.122.184	445 TCP	mssecsvc.exe PID: 2796	China
123.78.206.167	445 TCP	mssecsvc.exe PID: 2796	China
70.132.30.244	445 TCP	mssecsvc.exe PID: 2796	United States
105.173.213.85	445 TCP	mssecsvc.exe PID: 2796	Angola
30.19.134.242	445 TCP	mssecsvc.exe PID: 2796	United States
187.79.79.25	445 TCP	mssecsvc.exe PID: 2796	Brazil
214.69.119.3	445 TCP	mssecsvc.exe PID: 2796	United States
21.212.7.39	445 TCP	mssecsvc.exe PID: 2796	United States
190.199.83.10	445 TCP	mssecsvc.exe PID: 2796	Venezuela
179.54.235.1	445 TCP	mssecsvc.exe PID: 2796	Brazil
25.69.75.241	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
88.227.160.59	445 TCP	mssecsvc.exe PID: 2796	Turkey
159.46.149.26	445 TCP	mssecsvc.exe PID: 2796	Netherlands
142.220.125.169	445 TCP	mssecsvc.exe PID: 2796	Canada
191.168.37.224	445 TCP	mssecsvc.exe PID: 2796	Brazil
153.138.62.191	445 TCP	mssecsvc.exe PID: 2796	Japan
28.26.35.70	445 TCP	mssecsvc.exe PID: 2796	United States
196.88.174.1	445 TCP	mssecsvc.exe PID: 2796	Morocco
14.88.204.18	445 TCP	mssecsvc.exe PID: 2796	Korea, Republic of
207.90.134.243	445 TCP	mssecsvc.exe PID: 2796	United States
2.218.145.243	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
150.13.5.169	445 TCP	mssecsvc.exe PID: 2796	Japan
78.64.88.96	445 TCP	mssecsvc.exe PID: 2796	Sweden
79.134.95.63	445 TCP	mssecsvc.exe PID: 2796	Russian Federation
97.30.169.138	445 TCP	mssecsvc.exe PID: 2796	United States
163.138.6.233	445 TCP	mssecsvc.exe PID: 2796	Japan
71.144.87.225	445 TCP	mssecsvc.exe PID: 2796	United States
179.182.197.250	445 TCP	mssecsvc.exe PID: 2796	Brazil
161.62.201.84	445 TCP	mssecsvc.exe PID: 2796	Switzerland
29.155.143.196	445 TCP	mssecsvc.exe PID: 2796	United States
81.86.77.212	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
64.78.151.157	445 TCP	mssecsvc.exe PID: 2796	United States
17.224.146.5	445 TCP	mssecsvc.exe PID: 2796	United States
212.222.227.103	445 TCP	mssecsvc.exe PID: 2796	United Kingdom
34.164.146.165	445 TCP	mssecsvc.exe PID: 2796	United States
34.78.82.178	445 TCP	mssecsvc.exe PID: 2796	United States
60.108.64.162	445 TCP	mssecsvc.exe PID: 2796	Japan
154.130.110.185	445 TCP	mssecsvc.exe PID: 2796	Egypt
179.118.207.233	445 TCP	mssecsvc.exe PID: 2796	Brazil
207.226.179.212	445 TCP	mssecsvc.exe PID: 2796	United States
49.166.190.101	445 TCP	mssecsvc.exe PID: 2796	Korea, Republic of
38.144.63.69	445 TCP	mssecsvc.exe PID: 2796	United States
188.54.103.233	445 TCP	mssecsvc.exe PID: 2796	Saudi Arabia
53.119.138.59	445 TCP	mssecsvc.exe PID: 2796	Germany
11.169.8.131	445 TCP	mssecsvc.exe PID: 2796	United States
69.178.15.107	445 TCP	mssecsvc.exe PID: 2796	United States
30.125.242.252	445 TCP	mssecsvc.exe PID: 2796	United States
3.134.184.161	445 TCP	mssecsvc.exe PID: 2796	United States
52.84.183.7	445 TCP	mssecsvc.exe PID: 2796	United States
25.8.228.60	445 TCP	mssecsvc.exe PID: 2796	United Kingdom